From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

Microsoft Threat Intelligence observed a large macOS ClickFix campaign that mass-produces look-alike domains and uses a server-side browser‑fingerprinting gate to show malicious “Download for macOS” paste‑to‑Terminal lures only to qualified macOS browser visitors; the gated flow delivers infostealers including MacSync and Atomic Stealer (AMOS), and the report provides domain naming patterns, fingerprinting checks, the full infection chain, IOCs, and hunting/mitigation guidance.