Plan
active
macOS ClickFix campaign adds browser-fingerprinting gate to hide lures
- Engineer — Learn: No patch or config action required; the shift to fingerprinting-gated delivery changes how malicious infra evades scanners, worth understanding when evaluating endpoint controls for macOS fleets.
- SOC/IR — Plan: The new fingerprinting gate creates a hunting opportunity — build or tune detections for ClickFix-style clipboard-injection lures on macOS endpoints, and review proxy/DNS logs for infra that only responds to specific browser profiles.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.