macOS ClickFix TDS fingerprinting gate - hidden form POST correlating mode:php, platform spoof-check, and WebGL vendor/renderer fields in fingerprint JSON

Duo Tech@duotech

•updated Aug 7, 2026•1•0•3

Detects a specific fingerprinting activity by the ClickFix Traffic Direction System (TDS) within HTTP POST request bodies. The rule identifies the combination of 'mode:php', a 'MacIntel' platform string (spoof-check), and WebGL rendering fields ('webglVendor', 'webglRenderer') in a JSON-encoded body, which is characteristic of the macOS ClickFix infostealer campaign delivery.