# Clustering macOS ClickFix Campaign Webpages Using the HTTP-Basma Fingerprinting Algorithm

# Introduction

On August 5, 2026, the Microsoft Security Research Team (MSRT) blogged about a new macOS ClickFix campaign titled [From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide](https://www.microsoft.com/en-us/security/blog/2026/08/05/macos-clickfix-campaign-learned-hide/).

What's unique about this campaign is the use of TDS and fingerprinting gates to decide whether to serve the malicious page to the target user, luring the user into downloading the infostealers MacSync and Atomic Stealer (AMOS). This campaign uses groups of domain names with similar naming conventions.

The MSRT team shared 17 of those domains, listed here for reference:

```plaintext
applefilevault[.]com
apricotfilepoint[.]com 
bananafastfile[.]com
cloudfilebridge[.]com
filecedarwallet[.]online
filecopperbasket[.]sbs
filecrimsonsignal[.]online
filemarblegarden[.]sbs
fileoceanhammer[.]sbs
filerubyfolder[.]sbs
filevelvettractor[.]sbs
lemonfilewave[.]com
limefilescope[.]com
mangocloudfile[.]com
orangesmartfile[.]com
syncdatavault[.]com
cloudsendhub[.]com
```

# Servers Fingerprints

This campaign serves as a good case study for using [HTTP-Basma](https://httpbasma.netomize.ca/) for HTTP server fingerprinting and the clustering of those fingerprints.

We've already submitted those domains to [https://httpbasma.netomize.ca/](https://httpbasma.netomize.ca/) for fingerprinting, and as a result, we get 3 (actually 2) unique clusters:

*   **Cluster A** - \[**15**\] Verbosus fingerprint: 01140a85e40014514bd522142494d672140a85e4721420958a220c0c140a85e4720000001609
    
    *   applefilevault\[.\]com apricotfilepoint\[.\]com bananafastfile\[.\]com cloudfilebridge\[.\]com filecedarwallet\[.\]online filecopperbasket\[.\]sbs filemarblegarden\[.\]sbs filerubyfolder\[.\]sbs filevelvettractor\[.\]sbs lemonfilewave\[.\]com limefilescope\[.\]com mangocloudfile\[.\]com orangesmartfile\[.\]com syncdatavault\[.\]com cloudsendhub\[.\]com
        
*   **Cluster B** - \[**1**\] Verbosus fingerprint: 01140a85e40014514bd522142494d672140a85e4721420958a22000c140a85e4720000001609
    
    *   fileoceanhammer\[.\]sbs
        
*   **Cluster C** - \[**1**\] Verbosus fingerprint: 0100000000000000000000000000000000000000000000000000000000000000000000000000
    
    *   filecrimsonsignal\[.\]online
        

# Clustering

As shown above, **cluster C** indicates a dead domain. **Cluster A** contains the majority of the domains (15), and **cluster B** consists of 1 domain. Now, you might be asking yourself, what's the difference between **cluster A** and **cluster B** verbosus fingerprints? They look very similar, but it is not possible to tell the actual difference at the probe or field level just by comparing them one byte at a time; For that, we use the Compare function available under [https://httpbasma.netomize.ca/#compare](https://httpbasma.netomize.ca/#compare) to compare the two fingerprints, placing them next to each other, ':' separated.

The following screenshot shows the actual difference at the probe and field level, and, as shown, it is probe P6F (GET Request — Accept-Encoding, Full); Meaning, for **cluster A**, the server returned an actual value for this probe, which maps to the fingerprint 0c, whereas for **cluster B**, the server returned no value, indicated by the fingerprint 00.

![](https://cdn.hashnode.com/uploads/covers/698bbaaf2b3404faadd9aff8/f0510232-d2d9-47ca-86a3-6a79975a1315.png align="center")

In JSON format:

```json
[
  {
    "fp1": "01140a85e40014514bd522142494d672140a85e4721420958a220c0c140a85e4720000001609",
    "fp2": "01140a85e40014514bd522142494d672140a85e4721420958a22000c140a85e4720000001609",
    "result": "not_equal",
    "p6f": {
      "content_encoding": {
        "fp1": "0c",
        "fp2": "00"
      }
    }
  }
]
```

In case you're curious about what the FP 0c decodes to, you could use the Demangle feature https://httpbasma.netomize.ca/#demangle, using the newly implemented graph feature to visualize it as a graph:

![](https://cdn.hashnode.com/uploads/covers/698bbaaf2b3404faadd9aff8/454ccf10-42ae-456a-8926-f4e52a23fb66.svg align="center")

Therefore, the fingerprint 0c demangles to the content-encoding type **zstd** returned by the server for the probe p6f.

# DB-Match (The Majestic Million HTTP-Basma DB)

Now that we have all the fingerprints clustered, the next step would be to check for potential false positives in the Majestic Million HTTP-Basma database for servers that share a given fingerprint, which you could access via https://httpbasma.netomize.ca/#dbmatch. Searching for **Cluster A** and **Cluster B** verbosus fingerprints yields no matches.

# Conclusion

In this blog post, we used the HTTP-Basma platform for fingerprinting newly disclosed macOS ClickFix campaign webpages. Additionally, we highlighted some of the platform's capabilities to cluster those fingerprints, compare them and demangle them.

* * *

Mohamad Mokbel

August 06, 2026