250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks

Atomic Stealer is being pushed at Mac users through websites that look harmless. A large ClickFix operation uses more than 250 look-alike domains to steer selected visitors toward a fake download page and a malicious Terminal command. ClickFix is built on persuasion, not a software flaw. The pages pose as download checks, updates, or CAPTCHA-style verifications, then urge people to paste a command into Terminal to begin the attack. Microsoft analysts identified this shift. They found that the infrastructure moved from openly displaying malicious instructions to testing each visitor before deciding whether to reveal them. This makes routine scanning less reliable. The counterfeit ‘Download for macOS’ page served...

Read the full article at the source.