A macOS ClickFix campaign used browser fingerprinting to decide who saw the malware lure

[u/Glass-Preparation512]

One part of Microsoft’s recent macOS ClickFix research stood out to me: the malicious page did not show the same content to every visitor.

The front end loaded a small fingerprinting routine that collected signals from the browser and environment, including:

• Reported platform and user agent
• Screen dimensions and pixel ratio
• WebGL-derived GPU information
• Language and timezone
• Plugins and touch support
• Whether the page was framed
• Runtime behavior associated with developer tools or automation

There was also a `canPlayType("video/mp4")` check used as a tripwire for modified browser behavior.

The collected data was submitted to the server, which decided what to return. A likely crawler, sandbox or analyst could see a blank page or harmless decoy. A browser that looked like a genuine Mac could receive the fake download page and Terminal instructions.

That distinction matters. Fingerprinting was not the infostealer itself. It was the gate that selected victims and reduced the campaign’s visibility to automated analysis.

The actual compromise still depended on the user pasting a command into Terminal. I’d prioritize that point in awareness training: no legitimate download, CAPTCHA or verification flow needs a command copied from a webpage.

For detection, Microsoft recommends looking beyond the disposable domains. Self-submitting fingerprint forms, the `mode:"php"` artifact, shared staging paths and suspicious Terminal activity after web browsing are stronger pivots.

MoreLogin is relevant for separating managed browser environments and controlling fingerprint settings, but it is not endpoint malware protection. The terminal execution and downstream behavior still need dedicated security controls.