A macOS malware campaign hides its lure from automated inspection

Microsoft reported on 5 August that a macOS ClickFix operation moved from openly displaying its lure to using server-side checks of the visitor’s browser environment. The gate primarily exposed the prompt to visitors that appeared to be genuine macOS users.

The reported chain delivered information stealers including MacSync and Atomic Stealer. Selective delivery reduced what some crawlers and analysis systems could see, while the target still received instructions to run content locally. The investigation shows a limitation of checking a page once from an unrelated environment: the response can differ for the intended victim. Microsoft’s account identifies a specific monitored campaign, not every site using browser fingerprinting.