Browser Fingerprinting Powers a Massive macOS Malware Lure Campaign

macOS malware lure Uses Browser Fingerprinting

Microsoft Threat Intelligence observed a coordinated ClickFix operation that now runs behind more than ↓ 250 front‑end domains. The infrastructure first fingerprints a visitor’s browser, then decides whether to serve a fake macOS installer. Legitimate crawlers and sandbox analyses are met with a clean page, while targeted Mac users see a convincing download prompt. Only devices that match the fingerprint get the lure, a tactic that raises the success rate of the campaign.

“The gatekeeper logic effectively hides malicious content from automated analysis,” a security researcher noted.

Analysts say the shift mirrors a broader trend where attackers weaponize client‑side profiling to evade detection. The malicious payload, disguised as a popular utility, exploits a known macOS vulnerability that remains unpatched on many systems. Reuters and Bloomberg have reported similar tactics in unrelated campaigns.

Understanding the fingerprinting criteria could help defenders build more resilient filters. The episode also reminds enterprises that legacy macOS fleets, still in use after the pandemic surge, are prime targets for such sophisticated lures.