250+ ClickFix Domains Use Browser Fingerprinting to Target macOS Users with AMOS Stealer

Microsoft Threat Intelligence disclosed on August 5 that a ClickFix campaign spanning more than 250 front-end domains has added a server-side browser-fingerprinting gate to its delivery chain [1]. The gate examines each visitor's environment and only presents the malicious lure to sessions that look like genuine macOS browsers. Everyone else, including crawlers, sandboxes, and Windows users, sees harmless content or nothing at all. The final payload in the analyzed chain is Atomic Stealer (AMOS), an infostealer built to strip credentials, browser-saved passwords, cryptocurrency wallets, and authentication stores from macOS systems [1].

This is not spray-and-pray phishing with a Mac-flavored skin. The operators engineered an entire filtering layer so the campaign stays invisible to most automated defenses while presenting a polished, platform-native social engineering lure to the exact audience most likely to fall for it.

Background: ClickFix as a Social Engineering Technique

ClickFix was first documented in October 2023 as a social engineering pattern built around a single trick: show the victim a fake error message or CAPTCHA prompt, then instruct them to paste a command into Terminal (macOS) or PowerShell (Windows) to "fix" the problem. The command is the first stage of a malware delivery chain. Because the user executes the payload manually, endpoint protections that trigger on automated download-and-run sequences often miss it entirely.

Early ClickFix campaigns predominantly targeted Windows users. The technique has since been adopted by a range of operators, from commodity crimeware groups to, according to public reporting, state-aligned actors, and the macOS pivot tracked by Microsoft represents a mature, operationally disciplined variant of the approach [1].

The Domain Generation Pattern

Microsoft confirmed more than 250 domains active during the tracking window [1]. The domain names follow an algorithmic generation scheme anchored to a "file" token. The primary pattern pairs "file" at the beginning of the string with dictionary-style words: filecopperbasket, filevelvettractor, fileoceanhammer, filemarblegarden [1].

Variant patterns place the token in the middle or end of the domain name: applefilevault, bananafastfile, orangesmartfile [1]. A subset drops the token altogether, using generic cloud-themed names: cloudsendhub, syncdatavault [1]. This diversity makes simple string-matching or keyword blocklists unreliable as a sole detection strategy. Defenders need to understand the generation logic, not just list known examples.

Editorial note: The domain patterns cloudsendhub and syncdatavault require manual verification against the full Microsoft blog post before publication. They could not be independently confirmed in secondary reporting.

How the Fingerprinting Gate Works

Microsoft's analysis shows the campaign evolved from openly serving ClickFix lures to everyone, toward a server-side cloaking model [1]. When a visitor hits one of the 250+ domains, the server inspects environmental signals: operating system, browser type, and likely additional session attributes. Only visitors whose fingerprint is consistent with a genuine macOS browser session receive the malicious page [1].

This cloaking has two practical effects:

• Scanner blindness. Most web crawlers, threat intelligence bots, and automated sandboxes present default or Windows-based fingerprints. The gate shows them benign content, so the domain passes reputation checks.
• Noise reduction. Serving a macOS-specific lure to a Windows user wastes the interaction and risks early detection. Filtering at the gate keeps the campaign tight and quiet.

Conditional content delivery is not new. Historically, exploit kits from the mid-2010s, ad fraud networks, and nation-state watering hole operations all used similar techniques. Seeing it deployed at commodity scale, across hundreds of algorithmically generated domains, signals that the operators are likely borrowing from more advanced playbooks and applying them with real operational discipline.

The Lure: Spoofed GitHub "Download for macOS" Page

The lure page itself is a counterfeit "Download for macOS" prompt dressed in GitHub-themed branding, complete with forged "Verified Publisher" badges [1]. Microsoft emphasized that the GitHub branding is entirely spoofed; no compromise of GitHub infrastructure occurred [1].

The page uses macOS-native UI conventions and social engineering cues designed to appear familiar to macOS users. The Terminal command that the user is asked to paste uses macOS-native syntax [1]. This platform-specific polish matters: a Windows-style error dialog shown to a macOS user is immediately suspicious, but a convincing macOS dialog that matches what the user sees daily is far more likely to produce compliance.

The Kill Chain: From Paste to AMOS

Once the victim copies and pastes the command into Terminal, it calls out to a /curl/<id> URL on the attacker's infrastructure to retrieve a remote script [1]. The chain passes through multiple stages before ultimately downloading and launching Atomic Stealer (AMOS) [1].

AMOS is a well-documented macOS infostealer. Its collection targets include:

• Browser-saved credentials and cookies
• Cryptocurrency wallet data (Metamask, Phantom, and others)
• macOS Keychain entries
• Authentication stores and session tokens
• Sensitive files from the user's home directory [1]

The wider cluster associated with this infrastructure also distributed MacSync, a separate macOS-targeted payload [1]. The specific chain analyzed through the fingerprinting gate ended in AMOS [1].

IOC Table

Note: Microsoft published domain name patterns, not full FQDNs with TLDs. The brackets above denote that the TLD varies. Defenders should hunt on these base strings across DNS logs.

MITRE ATT&CK Mapping

Detection and Hunting

DNS and Proxy Logs

The algorithmic domain generation scheme gives defenders a concrete detection angle. Hunt for DNS queries or proxy connections to domains containing the strings filecopper, filevelvet, fileocean, filemarble, applefile, bananafast, orangesmart, cloudsendhub, or syncdatavault [1]. Build wildcard or regex queries:

index=dns (query="*filecopper*" OR query="*filevelvet*" OR query="*fileocean*" OR query="*filemarble*" OR query="*applefile*" OR query="*bananafast*" OR query="*orangesmart*" OR query="*cloudsendhub*" OR query="*syncdatavault*")

This will not catch every variant (the DGA can produce many combinations), but it covers the named patterns from Microsoft's report.

Endpoint Telemetry (macOS)

Look for Terminal.app or bash/zsh child processes spawned by browser processes (Safari, Chrome, Firefox). ClickFix requires the user to open Terminal and paste a command, so the process tree will show a shell session initiated outside normal developer or IT workflows. On endpoints with command-line audit logging enabled, hunt for curl commands pulling from unfamiliar /curl/ URL paths.

Network Signatures

The staged payload retrieval follows a /curl/<id> URL pattern [1]. This is unusual for legitimate web traffic. A Suricata or Snort rule matching HTTP GET requests to URI paths matching /curl/[a-zA-Z0-9]+ on recently registered domains would provide a useful detection signal, though tuning will be necessary to avoid false positives from legitimate API endpoints.

Behavioral Indicators

AMOS exfiltration typically involves rapid, sequential reads of Keychain databases, browser profile directories, and cryptocurrency wallet config files followed by outbound data transfer. EDR solutions with file-access telemetry on macOS should alert on bulk reads from ~/Library/Keychains/, browser profile paths, and known wallet directories within a short time window.

Analysis

This campaign represents a notable operational upgrade for commodity macOS-targeted malware delivery. The combination of server-side fingerprinting, algorithmically generated domain infrastructure, and platform-native social engineering lures puts it well above the typical phishing campaign in terms of sophistication.

The choice of AMOS as the final payload makes financial sense. macOS users are disproportionately represented in finance, software development, and cryptocurrency trading. AMOS is purpose-built to extract exactly the data that is most valuable in those contexts: credentials, session tokens, and wallet keys.

The spoofed GitHub branding is particularly effective targeting. Developers routinely download tools and utilities from GitHub. A "Download for macOS" page with a "Verified Publisher" badge exploits that trust directly. This makes tech-sector employees, who might otherwise be security-savvy, especially vulnerable to this specific lure design.

The fingerprinting gate complicates traditional threat intelligence workflows. URL scanners, automated phishing detection, and reputation services that visit suspicious domains with default browser fingerprints will categorize these sites as benign. Defenders relying solely on external reputation feeds for protection will have a blind spot here.

References

[1] Microsoft Security Blog, "From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide," August 5, 2026. https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/

Hunt Guide: ClickFix Campaign with Browser Fingerprinting Delivering AMOS Stealer to macOS

Attribution: Detection logic below credits its original author. Rules adapted, ported, or quoted from a public source retain that source's author (e.g. SigmaHQ / Florian Roth, Elastic, Emerging Threats, Abuse.ch, or the cited vendor/researcher). Only rules explicitly marked RedSheep Security/Stone (original) were authored in-house. If you reuse a rule, preserve its stated attribution.

Hypothesis: If the ClickFix campaign with server-side browser fingerprinting is targeting our macOS users, we expect to observe DNS queries to algorithmically generated domains containing 'file' tokens, Terminal.app or shell processes spawned by browser processes, curl commands fetching from /curl/ URI paths, and rapid sequential access to Keychain, browser credential stores, and cryptocurrency wallet directories on macOS endpoints.

Intelligence Summary: A ClickFix social engineering campaign spanning 250+ algorithmically generated domains uses server-side browser fingerprinting to exclusively serve malicious lures to macOS users while presenting benign content to scanners, sandboxes, and Windows users. The campaign spoofs GitHub 'Download for macOS' pages to trick victims into pasting commands into Terminal, ultimately delivering Atomic Stealer (AMOS), a macOS infostealer that harvests credentials, browser data, cryptocurrency wallets, and Keychain entries. The infrastructure also distributes MacSync, suggesting this may function as a malware-as-a-service delivery platform.

Confidence: Moderate | Priority: High

Scope

• Networks: All network segments containing macOS endpoints, with emphasis on developer workstations, finance team systems, and any segments with cryptocurrency-related activity. Include DMZ and guest network segments where BYOD macOS devices may connect.
• Timeframe: Hunt window: 30 days retrospective from hunt initiation date. The campaign was publicly disclosed August 5, 2026, but evolved from earlier open-lure variants. Extend to 60 days if initial results show hits.
• Priority Systems: macOS endpoints used by software developers, DevOps engineers, finance/trading personnel, cryptocurrency-adjacent teams, and executive staff. Systems with access to GitHub, code repositories, or development tools are highest priority given the GitHub-spoofed lure design.

MITRE ATT&CK Techniques

T1204.004 — User Execution: Malicious Copy and Paste (Execution) [P2]

The ClickFix campaign instructs victims to copy a command from a spoofed GitHub page and paste it into macOS Terminal. This manual user execution bypasses endpoint protections that trigger on automated download-and-run sequences.

Splunk SPL:

index=endpoint sourcetype=macos_process_events (process_name="Terminal" OR process_name="bash" OR process_name="zsh" OR process_name="sh") parent_process_name IN ("Safari", "Google Chrome", "Firefox", "Microsoft Edge", "Brave Browser", "Arc") | stats count by host, user, parent_process_name, process_name, process_command_line, _time | sort -_time

Elastic KQL:

process.name:("Terminal" OR "bash" OR "zsh" OR "sh") AND process.parent.name:("Safari" OR "Google Chrome" OR "Firefox" OR "Microsoft Edge" OR "Brave Browser" OR "Arc") AND host.os.type:"macos"

Sigma Rule:

title: Shell Process Spawned by Browser on macOS - ClickFix Indicator
id: 8a3c1f2d-5e7b-4a9c-b1d3-6f8e2c4a7b90
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects Terminal or shell processes spawned as children of browser processes on macOS, indicative of ClickFix-style user execution where victims paste commands into Terminal.
logsource:
  category: process_creation
  product: macos
detection:
  selection_parent:
    ParentImage|endswith:
      - '/Safari'
      - '/Google Chrome'
      - '/Firefox'
      - '/Microsoft Edge'
      - '/Brave Browser'
      - '/Arc'
  selection_child:
    Image|endswith:
      - '/Terminal'
      - '/bash'
      - '/zsh'
      - '/sh'
  condition: selection_parent and selection_child
level: high
tags:
  - attack.execution
  - attack.t1204.004
falsepositives:
  - Developer workflows that legitimately open Terminal from browser links
  - IT automation tools triggered from web interfaces

Attribution: RedSheep Security/Stone (original)

False positives may occur from developers using legitimate 'Open in Terminal' browser extensions or web-based IDE workflows. Baseline normal browser-to-terminal activity per user before alerting. Focus on non-developer macOS users first.

T1059.004 — Command and Scripting Interpreter: Unix Shell (Execution) [P1]

The payload delivered via ClickFix uses macOS-native Terminal commands including curl to fetch subsequent stages from attacker infrastructure via /curl/<id> URL paths.

Splunk SPL:

index=endpoint sourcetype=macos_process_events (process_name="curl" OR process_command_line="*curl*") process_command_line="*/curl/*" | eval suspicious_path=if(match(process_command_line, "/curl/[a-zA-Z0-9]+"), "YES", "NO") | where suspicious_path="YES" | stats count by host, user, process_command_line, parent_process_name, _time | sort -_time

Elastic KQL:

process.name:"curl" AND process.command_line:*/curl/* AND host.os.type:"macos"

Sigma Rule:

title: Curl Command Fetching from Suspicious /curl/ URI Path on macOS
id: 2b4d6e8f-1a3c-5d7e-9f0b-3c5e7a9d1b2f
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects curl commands on macOS that fetch from URI paths matching /curl/<id>, associated with ClickFix campaign staging infrastructure.
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: '/curl'
    CommandLine|re: 'https?://[^/]+/curl/[a-zA-Z0-9]+'
  condition: selection
level: high
tags:
  - attack.execution
  - attack.t1059.004
falsepositives:
  - Legitimate API endpoints using /curl/ in their path structure
  - Developer testing of curl-based APIs

Attribution: RedSheep Security/Stone (original)

The /curl/<id> URI pattern is specific to this campaign's staging infrastructure. Tune by whitelisting known legitimate internal and external APIs that use /curl/ in their paths. Correlate with DNS queries to recently registered domains.

T1583.001 — Acquire Infrastructure: Domains (Resource Development) [P1]

The campaign uses 250+ algorithmically generated domains following patterns anchored to a 'file' token (e.g., filecopperbasket, filevelvettractor) with variant patterns placing 'file' mid-string or at the end, plus cloud-themed names without the token.

Splunk SPL:

index=dns OR index=proxy (query="*filecopper*" OR query="*filevelvet*" OR query="*fileocean*" OR query="*filemarble*" OR query="*applefile*" OR query="*bananafast*" OR query="*orangesmart*" OR query="*cloudsendhub*" OR query="*syncdatavault*" OR url="*filecopper*" OR url="*filevelvet*" OR url="*fileocean*" OR url="*filemarble*" OR url="*applefile*" OR url="*bananafast*" OR url="*orangesmart*" OR url="*cloudsendhub*" OR url="*syncdatavault*") | stats count values(src_ip) as source_ips values(query) as domains by host | sort -count

Elastic KQL:

dns.question.name:(*filecopper* OR *filevelvet* OR *fileocean* OR *filemarble* OR *applefile* OR *bananafast* OR *orangesmart* OR *cloudsendhub* OR *syncdatavault*)

Sigma Rule:

title: DNS Query to ClickFix DGA Domain Pattern
id: 4c6e8a0b-2d4f-6e8a-0c2d-4f6e8a0b2d4f
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects DNS queries to domains matching the algorithmically generated patterns used by the ClickFix campaign delivering AMOS stealer to macOS users.
logsource:
  category: dns
detection:
  selection:
    query|contains:
      - 'filecopper'
      - 'filevelvet'
      - 'fileocean'
      - 'filemarble'
      - 'applefile'
      - 'bananafast'
      - 'orangesmart'
      - 'cloudsendhub'
      - 'syncdatavault'
  condition: selection
level: high
tags:
  - attack.resource_development
  - attack.t1583.001
falsepositives:
  - Highly unlikely for legitimate domains to match multiple DGA patterns
  - Individual patterns like 'applefile' could match legitimate Apple-related services - verify context

Attribution: RedSheep Security/Stone (original)

These patterns are derived from Microsoft's published DGA analysis. The DGA can produce many more combinations beyond these named patterns. Consider building a broader regex that matches 'file' + two concatenated dictionary words as domain names. Monitor for new variants by hunting for recently registered domains with 'file' prefix patterns.

T1036.005 — Masquerading: Match Legitimate Name or Location (Defense Evasion) [P2]

The campaign uses spoofed GitHub branding with forged 'Verified Publisher' badges to create convincing 'Download for macOS' lure pages that exploit developer trust in the GitHub platform.

Splunk SPL:

index=proxy OR index=web_gateway (url="*github*" OR referer="*github*") NOT (dest_host="github.com" OR dest_host="*.github.com" OR dest_host="*.githubusercontent.com" OR dest_host="*.github.io") | eval potential_spoof=if(match(url, "(?i)(github|download.*macos|verified.*publisher)"), "YES", "NO") | where potential_spoof="YES" | stats count by src_ip, dest_host, url, _time | sort -_time

Elastic KQL:

(url.full:*github* OR http.request.referrer:*github*) AND NOT destination.domain:("github.com" OR "*.github.com" OR "*.githubusercontent.com") AND host.os.type:"macos"

Sigma Rule:

title: Potential GitHub Spoofed Domain Access from macOS
id: 6e8a0c2d-4f6e-8a0b-2d4f-6e8a0c2d4f6e
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects web requests containing GitHub-related keywords in the URL or path that are NOT directed to legitimate GitHub domains, potentially indicating access to spoofed GitHub lure pages used in ClickFix campaigns.
logsource:
  category: proxy
detection:
  selection:
    cs-uri|contains:
      - 'github'
      - 'download-macos'
      - 'verified-publisher'
  filter:
    r-dns|endswith:
      - '.github.com'
      - '.githubusercontent.com'
      - '.github.io'
    r-dns:
      - 'github.com'
  condition: selection and not filter
level: medium
tags:
  - attack.defense_evasion
  - attack.t1036.005
falsepositives:
  - Third-party GitHub mirrors or documentation sites
  - GitHub-related development tools hosted on non-GitHub domains

Attribution: RedSheep Security/Stone (original)

This detection is broad by design. Expect false positives from legitimate GitHub-related services not hosted on github.com. Use in conjunction with DGA domain pattern matching to increase confidence.

T1555 — Credentials from Password Stores (Credential Access) [P2]

AMOS harvests macOS Keychain entries and browser-saved credentials. Detection focuses on abnormal access patterns to Keychain databases and browser credential storage locations.

Splunk SPL:

index=endpoint sourcetype=macos_file_events (file_path="*/Library/Keychains/*" OR file_path="*/Login Data*" OR file_path="*/Cookies*" OR file_path="*/Web Data*" OR file_path="*Chrome/Default*" OR file_path="*Firefox/Profiles*" OR file_path="*Safari/LocalStorage*") process_name!="Safari" process_name!="Google Chrome" process_name!="Firefox" process_name!="SecurityAgent" process_name!="securityd" process_name!="loginwindow" | stats count dc(file_path) as unique_files values(file_path) as accessed_files by host, user, process_name, _time | where unique_files > 3 | sort -_time

Elastic KQL:

file.path:(*Keychains* OR *Login\ Data* OR *Cookies* OR *Web\ Data* OR *Chrome\/Default* OR *Firefox\/Profiles*) AND NOT process.name:("Safari" OR "Google Chrome" OR "Firefox" OR "SecurityAgent" OR "securityd" OR "loginwindow") AND host.os.type:"macos"

Sigma Rule:

title: Suspicious Access to macOS Credential Stores - AMOS Stealer Behavior
id: 8a0b2d4f-6e8a-0c2d-4f6e-8a0b2d4f6e8a
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects non-standard processes accessing macOS Keychain databases and browser credential stores, indicative of AMOS stealer credential harvesting activity.
logsource:
  category: file_access
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - '/Library/Keychains/'
      - '/Login Data'
      - '/Cookies'
      - '/Web Data'
  filter:
    Image|endswith:
      - '/Safari'
      - '/Google Chrome'
      - '/Firefox'
      - '/SecurityAgent'
      - '/securityd'
      - '/loginwindow'
      - '/CloudKeychainProxy'
  condition: selection and not filter
level: high
tags:
  - attack.credential_access
  - attack.t1555
falsepositives:
  - Password management applications
  - Legitimate backup or synchronization tools
  - Security software performing credential audits

Attribution: RedSheep Security/Stone (original)

AMOS performs rapid sequential reads across multiple credential stores. A single file access is less concerning than bulk access to Keychain + browser profiles + wallet directories in a short window. Correlate with process ancestry to identify if the accessing process was spawned from Terminal.

T1005 — Data from Local System (Collection) [P2]

AMOS collects cryptocurrency wallet data (Metamask, Phantom, etc.), sensitive files from the user's home directory, and authentication stores for exfiltration.

Splunk SPL:

index=endpoint sourcetype=macos_file_events (file_path="*Metamask*" OR file_path="*Phantom*" OR file_path="*Solflare*" OR file_path="*Exodus*" OR file_path="*Electrum*" OR file_path="*Coinbase*" OR file_path="*Atomic Wallet*" OR file_path="*Bitcoin*" OR file_path="*Ethereum*" OR file_path="*wallet.dat*" OR file_path="*vault.json*") process_name!="Google Chrome" process_name!="Firefox" process_name!="Brave Browser" | stats count dc(file_path) as unique_wallet_files values(file_path) as accessed_files values(process_name) as accessing_processes by host, user | where unique_wallet_files > 1 | sort -count

Elastic KQL:

file.path:(*Metamask* OR *Phantom* OR *Solflare* OR *Exodus* OR *Electrum* OR *Coinbase* OR *wallet.dat* OR *vault.json*) AND NOT process.name:("Google Chrome" OR "Firefox" OR "Brave Browser") AND host.os.type:"macos"

Sigma Rule:

title: Cryptocurrency Wallet File Access by Non-Browser Process on macOS
id: 0c2d4f6e-8a0b-2d4f-6e8a-0c2d4f6e8a0b
status: experimental
author: RedSheep Security/Stone
date: 2026/08/07
description: Detects non-browser processes accessing cryptocurrency wallet files on macOS, indicative of AMOS stealer or similar crypto-targeting malware.
logsource:
  category: file_access
  product: macos
detection:
  selection:
    TargetFilename|contains:
      - 'Metamask'
      - 'Phantom'
      - 'Solflare'
      - 'Exodus'
      - 'Electrum'
      - 'wallet.dat'
      - 'vault.json'
  filter:
    Image|endswith:
      - '/Google Chrome'
      - '/Firefox'
      - '/Brave Browser'
      - '/Safari'
      - '/Arc'
  condition: selection and not filter
level: high
tags:
  - attack.collection
  - attack.t1005
falsepositives:
  - Legitimate cryptocurrency applications performing normal file operations
  - Backup utilities accessing wallet directories

Attribution: RedSheep Security/Stone (original)

AMOS targets multiple wallet extensions and applications. The combination of wallet file access + Keychain access + browser credential access from the same process or within a short time window is a high-fidelity indicator. Prioritize alerts where multiple categories are triggered simultaneously.

T1539 — Steal Web Session Cookie (Credential Access) [P2]

AMOS collects browser cookies and session tokens from macOS systems to enable session hijacking and account takeover.

Splunk SPL:

index=endpoint sourcetype=macos_file_events (file_path="*Chrome*Cookies*" OR file_path="*Firefox*cookies.sqlite*" OR file_path="*Safari*Cookies.binarycookies*" OR file_path="*Edge*Cookies*") process_name!="Google Chrome" process_name!="Firefox" process_name!="Safari" process_name!="Microsoft Edge" | stats count values(file_path) as cookie_files values(process_name) as accessing_processes by host, user, _time | sort -_time

Elastic KQL:

file.path:(*Chrome*Cookies* OR *Firefox*cookies.sqlite* OR *Safari*Cookies.binarycookies* OR *Edge*Cookies*) AND NOT process.name:("Google Chrome" OR "Firefox" OR "Safari" OR "Microsoft Edge") AND host.os.type:"macos"

Cookie theft detection overlaps with T1555 credential store access detections. Correlate both for higher confidence. False positives from cookie-cleaning utilities or privacy tools are possible.

T1071.001 — Application Layer Protocol: Web Protocols (Command and Control) [P1]

The staged payload retrieval follows a /curl/<id> URL pattern for HTTP-based communication between the victim and attacker infrastructure.

Splunk SPL:

index=proxy OR index=web_gateway uri_path="/curl/*" | regex uri_path="/curl/[a-zA-Z0-9]+" | stats count by src_ip, dest_host, dest_ip, uri_path, http_method, _time | sort -_time

Elastic KQL:

url.path:\/curl\/* AND http.request.method:"GET"

The /curl/<id> URL pattern is the primary network indicator of payload staging. Some legitimate APIs may use /curl/ in paths. Cross-reference with domain age and DGA pattern matching to reduce false positives.

T1608.005 — Stage Capabilities: Link Target (Resource Development) [P2]

250+ domains host cloaked lure pages that serve different content based on visitor browser fingerprinting, presenting malicious ClickFix lures only to macOS browser sessions.

Splunk SPL:

index=dns query_type=A | eval domain_length=len(query) | where domain_length > 15 AND (match(query, "^file[a-z]+\.") OR match(query, "[a-z]+file[a-z]*\.")) | stats count by query, src_ip, _time | sort -count

Elastic KQL:

dns.question.name:/file[a-z]+\..*/ OR dns.question.name:/[a-z]+file[a-z]*\..*/

This broader regex-based hunt for 'file' token domains will generate more results than the specific DGA pattern matching. Use as a secondary sweep to identify new DGA variants not yet published.

T1497.001 — Virtualization/Sandbox Evasion: System Checks (Defense Evasion) [P3]

Server-side fingerprinting gate inspects visitor OS, browser type, and session attributes to exclude sandboxes, crawlers, and non-macOS users. Applied here by analogy as ATT&CK lacks a precise technique for server-side cloaking.

Splunk SPL:

index=proxy dest_host IN ("*filecopper*", "*filevelvet*", "*fileocean*", "*filemarble*", "*applefile*") | stats count by src_ip, dest_host, http_user_agent, status, _time | eval is_macos=if(match(http_user_agent, "(?i)macintosh|mac os x"), "YES", "NO") | sort -_time

Elastic KQL:

destination.domain:(*filecopper* OR *filevelvet* OR *fileocean* OR *filemarble* OR *applefile*) AND user_agent.os.name:"Mac OS X"

This technique is applied by analogy — the server-side cloaking is not a traditional endpoint sandbox evasion but achieves the same defensive effect. Key action item: verify your URL scanning tools can present macOS browser fingerprints to test suspicious domains.

Indicators of Compromise

IOC Sweep Queries (Splunk):

index=dns OR index=proxy (query="*filecopperbasket*" OR url="*filecopperbasket*" OR dest_host="*filecopperbasket*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*filevelvettractor*" OR url="*filevelvettractor*" OR dest_host="*filevelvettractor*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*fileoceanhammer*" OR url="*fileoceanhammer*" OR dest_host="*fileoceanhammer*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*filemarblegarden*" OR url="*filemarblegarden*" OR dest_host="*filemarblegarden*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*applefilevault*" OR url="*applefilevault*" OR dest_host="*applefilevault*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*bananafastfile*" OR url="*bananafastfile*" OR dest_host="*bananafastfile*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*orangesmartfile*" OR url="*orangesmartfile*" OR dest_host="*orangesmartfile*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*cloudsendhub*" OR url="*cloudsendhub*" OR dest_host="*cloudsendhub*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=dns OR index=proxy (query="*syncdatavault*" OR url="*syncdatavault*" OR dest_host="*syncdatavault*") | stats count by src_ip, query, dest_host, _time | sort -_time

index=proxy OR index=web_gateway uri_path="/curl/*" | regex uri_path="^/curl/[a-zA-Z0-9]+$" | stats count by src_ip, dest_host, dest_ip, uri_path, http_method, _time | sort -_time

YARA Rules

AMOS_Stealer_ClickFix_MacOS — Detects indicators of Atomic Stealer (AMOS) targeting macOS, including references to credential stores, cryptocurrency wallets, and characteristic strings associated with AMOS collection behavior.

rule AMOS_Stealer_ClickFix_MacOS {
    meta:
        author = "RedSheep Security/Stone"
        description = "Detects Atomic Stealer (AMOS) macOS infostealer indicators including Keychain harvesting, browser credential theft, and cryptocurrency wallet collection"
        date = "2026-08-07"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"
        threat = "AMOS Stealer"
        severity = "high"
    strings:
        $keychain1 = "/Library/Keychains/login.keychain-db" ascii
        $keychain2 = "security find-generic-password" ascii
        $keychain3 = "security find-internet-password" ascii
        $browser1 = "Login Data" ascii
        $browser2 = "Cookies" ascii
        $browser3 = "Web Data" ascii
        $browser4 = "Google/Chrome" ascii
        $browser5 = "Firefox/Profiles" ascii
        $wallet1 = "Metamask" ascii nocase
        $wallet2 = "Phantom" ascii nocase
        $wallet3 = "Solflare" ascii nocase
        $wallet4 = "Exodus" ascii nocase
        $wallet5 = "Electrum" ascii nocase
        $wallet6 = "wallet.dat" ascii
        $macsync = "MacSync" ascii
        $curl_stage = "/curl/" ascii
        $amos1 = "atomicstealer" ascii nocase
        $amos2 = "AMOS" ascii
    condition:
        uint32be(0) == 0xCFFA EDFE or  // Mach-O magic
        uint32be(0) == 0xFEEDFACE or
        uint32be(0) == 0xFEEDFACF or
        (
            (2 of ($keychain*)) or
            (2 of ($wallet*) and 1 of ($browser*)) or
            (1 of ($amos*) and (1 of ($keychain*) or 1 of ($wallet*))) or
            ($curl_stage and 1 of ($keychain*) and 1 of ($browser*))
        )
}

Attribution: RedSheep Security/Stone (original)

ClickFix_MacOS_Lure_Script — Detects shell scripts or downloaded content associated with the ClickFix macOS lure chain, including curl-based staging and Terminal command patterns.

rule ClickFix_MacOS_Lure_Script {
    meta:
        author = "RedSheep Security/Stone"
        description = "Detects ClickFix macOS lure scripts containing curl-based staging patterns and Terminal execution indicators"
        date = "2026-08-07"
        reference = "https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/"
        severity = "high"
    strings:
        $curl_pattern = /curl\s+(-[sSkLfO]\s+)*https?:\/\/[^\s]+\/curl\/[a-zA-Z0-9]+/ ascii
        $bash_exec = "bash -c" ascii
        $sh_exec = "sh -c" ascii
        $osascript = "osascript" ascii
        $chmod = "chmod +x" ascii
        $tmp_path = "/tmp/" ascii
        $github_spoof1 = "Download for macOS" ascii
        $github_spoof2 = "Verified Publisher" ascii
        $github_spoof3 = "github" ascii nocase
    condition:
        filesize < 500KB and
        (
            ($curl_pattern and ($bash_exec or $sh_exec)) or
            ($curl_pattern and $chmod and $tmp_path) or
            ($osascript and $curl_pattern) or
            (2 of ($github_spoof*) and ($curl_pattern or $bash_exec))
        )
}

Attribution: RedSheep Security/Stone (original)

Suricata Rules

SID 2026001 — Detects HTTP GET request to /curl/<id> URI path pattern used by ClickFix campaign for staged payload retrieval

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"REDSHEEP ClickFix Campaign Staged Payload Retrieval via /curl/ URI Path"; flow:established,to_server; http.method; content:"GET"; http.uri; content:"/curl/"; startswith; pcre:"/^\/curl\/[a-zA-Z0-9]{4,64}$/U"; classtype:trojan-activity; sid:2026001; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026002 — Detects DNS query to ClickFix DGA domain containing 'filecopper' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - filecopper Pattern"; dns.query; content:"filecopper"; nocase; classtype:trojan-activity; sid:2026002; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026003 — Detects DNS query to ClickFix DGA domain containing 'filevelvet' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - filevelvet Pattern"; dns.query; content:"filevelvet"; nocase; classtype:trojan-activity; sid:2026003; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026004 — Detects DNS query to ClickFix DGA domain containing 'fileocean' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - fileocean Pattern"; dns.query; content:"fileocean"; nocase; classtype:trojan-activity; sid:2026004; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026005 — Detects DNS query to ClickFix DGA domain containing 'filemarble' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - filemarble Pattern"; dns.query; content:"filemarble"; nocase; classtype:trojan-activity; sid:2026005; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026006 — Detects DNS query to ClickFix DGA domain containing 'applefile' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - applefile Pattern"; dns.query; content:"applefile"; nocase; classtype:trojan-activity; sid:2026006; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026007 — Detects DNS query to ClickFix DGA domain containing 'cloudsendhub' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - cloudsendhub Pattern (UNVERIFIED)"; dns.query; content:"cloudsendhub"; nocase; classtype:trojan-activity; sid:2026007; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026008 — Detects DNS query to ClickFix DGA domain containing 'syncdatavault' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - syncdatavault Pattern (UNVERIFIED)"; dns.query; content:"syncdatavault"; nocase; classtype:trojan-activity; sid:2026008; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026009 — Detects DNS query to ClickFix DGA domain containing 'bananafast' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - bananafast Pattern"; dns.query; content:"bananafast"; nocase; classtype:trojan-activity; sid:2026009; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

SID 2026010 — Detects DNS query to ClickFix DGA domain containing 'orangesmart' pattern

alert dns $HOME_NET any -> any any (msg:"REDSHEEP ClickFix DGA Domain - orangesmart Pattern"; dns.query; content:"orangesmart"; nocase; classtype:trojan-activity; sid:2026010; rev:1; metadata:created_at 2026_08_07, updated_at 2026_08_07;)

Attribution: RedSheep Security/Stone (original)

Data Source Requirements

Recommendations

• Deploy all Appendix B DNS and proxy log detection queries (DGA domain pattern matching) across all Splunk and Elastic instances monitoring DNS resolution from macOS-containing network segments
• Deploy Suricata rules SID 2026001-2026010 on all network sensors positioned to observe outbound DNS and HTTP traffic from macOS endpoints
• Enable and verify macOS command-line audit logging (Unified Logging or EDR-native) on all macOS endpoints to capture Terminal commands, with specific attention to curl invocations
• Configure EDR solutions to alert on Terminal.app or shell processes (bash, zsh, sh) spawned as children of browser processes (Safari, Chrome, Firefox, Edge, Arc) on macOS
• Verify that URL scanning and phishing detection tools in use can spoof macOS browser fingerprints (User-Agent, platform headers) when analyzing suspicious domains — reconfigure or supplement if they default to Windows/crawler profiles
• Block confirmed DGA domains at DNS and proxy layers as they are identified through hunting activities, and add wildcard blocks for the base patterns across all TLDs
• Brief macOS-heavy teams (developers, DevOps, design, finance) on this specific lure pattern: fake GitHub 'Download for macOS' pages requesting Terminal command execution are never legitimate — reinforce that no legitimate software installation requires pasting commands from a webpage into Terminal
• Deploy YARA rules AMOS_Stealer_ClickFix_MacOS and ClickFix_MacOS_Lure_Script to endpoint security solutions and email/web gateways for file scanning
• Monitor for AMOS stealer exfiltration behavior: rapid sequential reads of ~/Library/Keychains/, browser profile directories, and cryptocurrency wallet directories followed by outbound data transfer within a short time window
• Coordinate with threat intelligence team to monitor for new DGA variants beyond published patterns, tracking newly registered domains matching file + dictionary word concatenation patterns

Sources

• Microsoft Security Blog - From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide