Home / Cybersecurity / Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS…
Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures
thehackernews.com Aug 5, 2026

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

Curated by · TechCapsules ·

AI-summarised brief · reviewed before publication

Microsoft Threat Intelligence has identified a macOS ClickFix campaign that operates through more than 250 front‑end domains and uses browser fingerprinting to decide which visitors receive a malicious lure. A lightweight JavaScript gate collects hardware and browser attributes—such as platform string, screen size, WebGL data, timezone, and touch support—to distinguish real Macs from crawlers, sandboxes, or analysts. Qualified users are served a forged “Download for macOS” page with a fake Verified Publisher badge, prompting them to copy a Base64‑obfuscated Terminal command. When executed, the command fetches additional scripts and launches the AMOS infostealer, which harvests credentials, browser data, crypto wallets and sensitive files. The gate can also deliver blank pages or unrelated content to non‑targeted requests, making detection by static scanners difficult. Microsoft advises defenders to hunt the fingerprinting gate and monitor for unusual Terminal activity rather than chasing disposable domains.

💡 Why It Matters

  • · The server‑side fingerprinting lets attackers evade automated defenses and only expose the payload to genuine Mac users, dramatically increasing the success rate of the infection.
  • · Detecting the gate’s hidden fingerprint fields offers a practical early‑warning signal before any malware is delivered.
Capsules Cybersecurity
Read full article on thehackernews.com
More in Cybersecurity →
Advance Zero Trust for AI: New tools and guidance to secure AI agents and DevSecOps
microsoft.com · Aug 5

Advance Zero Trust for AI: New tools and guidance to secure AI…

Microsoft is expanding its Zero Trust for AI strategy by introducing a new AI-focused Zero Trust Assessment experience and a DevSecOps pillar within the Zero Trust Workshop. These additions aim to help organizations operationalize security for AI agents, Copilots, and autonomous workflows. The Assessment provides an automated view of security posture, evaluating tenant configurations and activity signals to generate prioritized remediation recommendations. It now includes new pillars for AI, Security Operations, and Infrastructure, alongside existing Identity, Devices, Network, and Data categories. The new DevSecOps pillar offers 15 control groups and 91 tasks to apply Zero Trust principles from source code to cloud deployment. This guidance addresses risks in CI/CD pipelines, dependencies, and infrastructure-as-code. The Workshop utilizes a First, Then, Next framework to create 12- to 24-month roadmaps. These tools build upon the Zero Trust for AI strategy announced at RSA Conference 2026, moving from architectural concepts to practical implementation for security and engineering teams.

💡 By integrating specific controls for AI-assisted development, Microsoft addresses the critical gap between rapid AI adoption and secure software delivery. This shift forces organizations to treat AI memory and automated code generation as governed security boundaries rather than black boxes.

US Reportedly Excludes Open-Weight AI Models From Cyber Tests
windowsreport.com · Aug 5

US Reportedly Excludes Open-Weight AI Models From Cyber Tests

The Trump administration has reportedly decided to exclude open-weight AI models from a new voluntary US government program designed to test advanced systems for sophisticated cyber operations. This decision was communicated to representatives from Meta, Google, Nvidia, OpenAI, and Anthropic during an August 4 White House meeting. The federal framework, established following a June 2 executive order, aims to create classified benchmarks to determine if frontier models can perform complex cyber operations threatening government systems or critical infrastructure. Testing will focus on proprietary models like Anthropic’s Mythos and Fable, and OpenAI’s GPT-5.6 Sol. Open-weight models, which allow developers to download, inspect, and modify underlying weights, are exempt. Critics argue this creates a security gap, as these models can spread rapidly and have safeguards removed. The White House has not clarified if the exclusion applies to all open-weight releases or only those below a specific capability threshold. Additionally, officials have not identified the operating federal agency, disclosed evaluation result publication plans, or defined consequences for models demonstrating dangerous capabilities. The voluntary nature of the program raises questions about developer compliance and future testing frameworks for open-weight systems.

💡 By exempting open-weight models, the government ignores the very systems most easily modified by malicious actors to bypass safety controls. This oversight leaves a critical blind spot in national cybersecurity defenses against rapidly proliferating, unregulated AI tools.

​Beyond Compliance: Understanding VCISO Leadership For SMBs And Mid-Market Companies
forbes.com · Aug 5

​Beyond Compliance: Understanding VCISO Leadership For SMBs And Mid-Market Companies

Scott Alldridge, CEO of IP Services and author of the VisibleOps series, argues that viewing cybersecurity strictly as a technology problem poses significant risks to modern businesses. He highlights a critical leadership gap affecting small and mid-market companies with fewer than 1,000 employees. These organizations are often too large to rely solely on IT managers for security decisions yet too small to afford a full-time chief information security officer. Consequently, many firms are rethinking their approach to security leadership. They seek to balance strategic guidance, governance expertise, and independent risk perspectives with their limited resources. Alldridge suggests that the solution involves supplementing internal teams rather than replacing them. He advocates for the adoption of virtual CISO services to provide experienced external leadership. This model allows smaller enterprises to access high-level security strategy without the overhead of a permanent executive hire. The article explores how this shift addresses the growing demand for robust security governance in the mid-market sector, offering a practical pathway for companies to enhance their cybersecurity posture while managing operational costs effectively.

💡 The vCISO model democratizes executive-level security strategy, allowing resource-constrained firms to bridge the gap between basic IT management and enterprise-grade governance. This shift transforms cybersecurity from a cost center into a strategic enabler for mid-market growth.

Silicon Valley’s Other China Problem: It’s Training Their AI
forbes.com · Aug 5

Silicon Valley’s Other China Problem: It’s Training Their AI

Silicon Valley data-labeling startups, valued at tens of billions of dollars, are simultaneously supplying AI training datasets to major American firms like OpenAI and Anthropic, as well as to Chinese laboratories. These Chinese entities are utilizing the purchased data to develop cost-effective AI models that increasingly rival their U.S. counterparts. Despite strict U.S. export controls on advanced semiconductor chips, no comparable restrictions exist for the high-quality training data essential for model development. Companies such as Tencent have actively solicited specialized datasets covering finance, cybersecurity, and self-improving AI systems. This dual-market strategy allows Chinese developers to access the same packaged human expertise that powers leading Western models. The data infrastructure, worth hundreds of millions annually, is critical for teaching complex professional tasks. Consequently, the unrestricted flow of training data is enabling Chinese AI models to rapidly close the technological gap with American rivals, creating a significant strategic vulnerability for U.S. tech dominance in the global artificial intelligence landscape.

💡 While Washington restricts hardware exports, the unregulated trade of training data effectively bypasses these controls, allowing adversaries to replicate American technological advantages. This loophole undermines the strategic intent of chip bans by providing the essential fuel needed to build competitive AI systems.

NuSummit Joins CREST AI Charter Founding Signatories to Advance Trusted AI in Cybersecurity
prnewswire.co.uk · Aug 5

NuSummit Joins CREST AI Charter Founding Signatories to Advance Trusted AI in…

NuSummit Cybersecurity has officially become a Founding Signatory of the CREST AI Charter, aligning with leading industry organizations to promote responsible artificial intelligence usage in cybersecurity. This commitment ensures NuSummit’s AI-enabled services adhere to CREST’s Nine Principles for AI-Enabled Activities, emphasizing strong governance, security, human oversight, and accountability. Anantharaman Sreenivasan, Managing Director and Group CEO, stated that governance and human oversight are non-negotiable as AI integration deepens. Sameer Shelke, President Americas and Cybersecurity Services Head, added that responsible AI must combine innovation with transparency. By joining as a founding signatory, NuSummit contributes to a shared effort to strengthen cybersecurity while maintaining professional standards and client confidence. The company serves over 300 clients worldwide, including 22 Fortune 500 firms, focusing on identity management, risk advisory, and managed detection. This move underscores NuSummit’s dedication to building trusted, accountable AI solutions for its global clientele in banking, insurance, and capital markets sectors.

💡 Establishing human oversight as a non-negotiable standard shifts the industry focus from pure automation to accountable AI governance. This commitment provides a concrete framework for maintaining client trust amidst rapid technological adoption.

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data
thehackernews.com · Aug 5

Open VSX Removes 77 Malicious Evil Twin Extensions Exfiltrating Developer Data

A total of 77 malicious extensions were discovered on the Open VSX marketplace, uploaded between July 26 and August 1, 2026. The “evil twin” packages masqueraded as legitimate developer tools, sending hostnames, operating‑system usernames, editor details, and workspace paths to the domain mangorbit.com. Most extensions transmitted only minimal data, while nineteen sent comprehensive system and repository information. All were removed from Open VSX on August 3, 2026, after security researchers Ax Sharma and Cody Nash identified the coordinated exfiltration campaign.

💡 The incident exposes how quickly supply‑chain attacks can infiltrate developer ecosystems, turning trusted marketplaces into vectors for mass data theft. It underscores the need for stricter vetting and monitoring of extension repositories to protect developers’ environments from covert surveillance.