Microsoft Threat Intelligence has identified a sophisticated macOS-targeted ClickFix campaign operating across over 250 domains that employs browser fingerprinting to selectively display malware lures. The server-side filtering mechanism allows attackers to evade detection by security crawlers and sandbox environments while specifically targeting Mac users with fraudulent software downloads.
A macOS ClickFix operation spanning more than 250 front-end domains now fingerprints visitors before deciding whether to show them a malware lure, a change Microsoft Threat Intelligence tracked on infrastructure it had been watching for weeks. The server-side gate hides the malicious page from crawlers and sandboxes while presenting selected Mac users with a fake software download. Microsoft
Originally published at thehackernews.com
60-minute technical evaluation, no obligation. We'll map the ideas in this article to your environment.
