The crews behind a long-running macOS scam have started doing something defenders usually do: vetting who is on the other end of a connection before committing to an attack.
Microsoft Threat Intelligence says a ClickFix operation pushing the MacSync and Atomic Stealer (AMOS) infostealers has rebuilt its front end around a browser-fingerprinting gate. The same infrastructure once served its malicious Terminal command to anyone who loaded the page.
Those domains now return a roughly 2.5 KB JavaScript profiler that quietly measures the visitor and posts the results back to the server. Only requests that look like a real Mac get the payload.
Microsoft confirmed more than 250 front-end domains during its tracking window, most churned out by a name generator that pairs the token "file" with dictionary words — filecopperbasket, fileoceanhammer, filemarblegarden. Others bury the token mid-name (applefilevault, bananafastfile) or drop it entirely (cloudsendhub, syncdatavault). Researchers caution that the pattern is a hunting pivot, not a signature.
The profiling runs deep. The script scrapes the navigator, screen, window, document, location, and console objects, then leans on WebGL — a browser graphics API — to pull the unmasked GPU vendor and renderer strings. An Apple GPU passes; ANGLE, SwiftShader, llvmpipe, VMware, or Parallels renderers expose a virtual machine.
It also reads timezone offset, touch-input support, and whether the page sits inside an iframe, and it sets traps for analysts: a toString() counter that trips when developer tools serialize console output, and a video codec check rigged to catch a patched Array.prototype.
Visitors who fail get a blank page or a decoy — Microsoft observed a fake "Urban VPN Proxy" extension page and a bogus freight-forwarding site on the same domain. Visitors who pass get a counterfeit "Download for macOS" page with GitHub-style branding, a forged "Verified Publisher" badge, and a Copy button that drops an obfuscated curl one-liner onto the clipboard. Running it pulls a script from a /curl/<id> path, which stages AMOS and starts harvesting keychain items, browser credentials, and cryptocurrency wallet files.
The practical lesson for defenders: a domain that looks clean when your scanner visits it may still be feeding malware to Macs. Microsoft recommends hunting the gate itself — self-submitting fingerprint forms, hidden data fields, the mode:"php" artifact — and blocking shared staging hosts rather than disposable front ends. Alert on Terminal sessions spawning curl, base64 or osascript shortly after web browsing.
Apple's own countermeasure shipped in macOS 26.4, which now blocks suspicious pastes into Terminal with a "Possible malware" warning.