macOS Script Editor Flaw Lets ClickFix Deliver Atomic Stealer

Key Takeaways

• A new ClickFix campaign is actively targeting macOS users, bypassing Terminal protections by leveraging the Script Editor application.
• The attack chain uses social engineering via fake Apple-themed webpages to trick users into executing malicious AppleScripts.
• The ultimate payload is the Atomic Stealer infostealer, designed to exfiltrate sensitive user data, including credentials and cryptocurrency wallets.
• This tactic demonstrates threat actors’ rapid adaptation to new security features, specifically Apple’s command-pasting scanner in macOS 26.4.

Threat actors operating the ClickFix campaign have developed a sophisticated new method to infect macOS systems, circumventing Apple’s enhanced security measures. Instead of relying on users to paste malicious commands into Terminal, this iteration exploits the built-in Script Editor application to deploy the Atomic Stealer infostealer.

This strategic shift highlights how quickly adversaries adapt their tactics in response to tightened platform security. It underscores the enduring effectiveness of social engineering, even against robust technical defenses.

Evolving Attack Vector

Historically, ClickFix attacks coerced users into copying and pasting malicious commands directly into Terminal, often under the guise of system troubleshooting or maintenance. Apple introduced a critical security feature in macOS 26.4 that actively scans commands pasted into Terminal before execution, significantly disrupting this common attack path.

Rather than abandoning their approach, the threat actors simply pivoted. They now utilize Script Editor, a native macOS application designed for AppleScript automation, which has a documented history of being exploited in malware delivery. This change allows them to bypass the new Terminal protections without triggering immediate alerts.

Researchers at Jamf Threat Labs identified this new variant through behavioral detection mechanisms that flagged the Script Editor-based execution as suspicious activity. Their discovery underscores the rapid evolution of attack methodologies in the face of new security controls. The actors leverage the applescript URL scheme to invoke Script Editor directly from a web browser, silently bypassing the Terminal safeguards.

The Social Engineering Lure

The attack initiates with a convincing fake Apple-themed webpage, designed to appear as a legitimate disk space cleanup utility. This page provides step-by-step instructions that closely mimic authentic macOS maintenance guides.

Upon clicking an “Execute” button on the fraudulent webpage, the browser silently triggers the applescript URL scheme. The user is then presented with a security permission dialog, prompting them to open Script Editor. This interaction is carefully crafted to appear as a routine system operation, masking the underlying malicious intent.

Once Script Editor launches, it displays a pre-populated script, ready for user execution. This script includes fake copyright headers, falsely attributing it to an Apple storage optimization utility, thereby enhancing its perceived legitimacy.

The user experience varies slightly depending on the macOS version. In macOS 26.4, users are prompted to approve saving the script to disk before it can proceed with execution.

Script Execution and Payload Delivery

When the user runs the pre-filled script, the core attack chain begins. The script contains an obfuscated command that uses the tr utility for character translation, converting a scrambled string into a functional URL at runtime. This URL then calls curl with the -k flag, which disables TLS certificate validation. This allows the malware to connect to untrusted infrastructure without generating security warnings. The downloaded content is then piped directly into zsh and executed entirely in memory, preventing it from touching the disk during this initial phase.

The first-stage payload is concealed using base64 encoding combined with gzip compression. After decoding, it retrieves a Mach-O binary, saves it to /tmp/helper, removes extended attributes, grants execution permissions, and then runs it. This binary is a recent variant of Atomic Stealer, a notorious macOS infostealer known for harvesting sensitive data such as browser credentials, saved passwords, and cryptocurrency wallet information from compromised systems.

Confirmed indicators of compromise (IoCs) for this campaign include the domain dryvecar.com, along with storage-fixes.squarespace.com and cleanupmac.mssg.me, all associated with the fake ClickFix webpages. The Mach-O binary saved as helper has the SHA-256 hash 3d3c91ee762668c85b74859e4d09a2adfd34841694493b82659fda77fe0c2c44.

What You Should Do

• Exercise Extreme Caution: Never execute scripts or commands prompted by external webpages, even if they appear to be from Apple or other trusted entities.
• Decline Browser Requests: Always decline browser requests to open Script Editor or any other automation tool if the source is unknown or suspicious.
• Keep macOS Updated: Ensure your macOS is running the latest available version to benefit from the newest built-in security controls and patches.
• Verify Sources: If you receive instructions for system maintenance, always verify them directly on Apple’s official support website or through trusted, known channels, rather than relying on external webpages.
• Use Security Software: Employ reputable endpoint detection and response (EDR) solutions that can identify and block suspicious behavioral patterns.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.