macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections — Threadlinqs Intelligence
As of 2026-05-30, macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections is a high-severity malware threat attributed to a N/A-nexus actor, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 66 indicators of compromise.
Threat ID: TL-2026-0396 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
Attribution: N/A · FINANCIAL
Netskope Threat Labs is tracking an active ClickFix social-engineering campaign targeting macOS users that lures victims to fake CAPTCHA/verification pages which instruct them to paste a curl-piped
Netskope Threat Labs published an April 20, 2026 analysis of an active ClickFix campaign retooled for macOS that abuses Apple's own scripting stack (osascript / AppleScript / Script Editor) to steal credentials, browser state, keychain contents, and cryptocurrency wallets from thousands of consumer and enterprise macOS endpoints. The campaign is notable because it (1) arrives immediately before Apple's macOS 26 ‘Tahoe’ hardening rollout, which introduces the first native Terminal paste-command scanner and restricted AppleEvents defaults purpose-built to disrupt ClickFix, and (2) operators have already iterated multiple payload variants to survive those mitigations.
Initial access follows the canonical ClickFix playbook. Victims are driven from malvertising, SEO-poisoned cryptocurrency sites, and typosquatted domains (e.g. comparisions[.]org, cryptoinfo-news[.]com, dryvecar[.]com, odyssey1[.]to, barbermoo[.]xyz) to fake CAPTCHA, Cloudflare-verification, or ‘repair your Mac’ pages. The lure presents a ‘Verification Steps’ or ‘System Maintenance’ panel instructing the user to press Command+Space, open Terminal, paste a pre-copied command, and press Return. The pasted command is a curl-piped-to-shell one-liner that silently downloads a second-stage shell wrapper and detaches via nohup with stdin/stdout/stderr redirected to /dev/null so the user sees no output and returns to a clean prompt.
The second stage is a heredoc-wrapped shell script (‘rogue.sh’ / ‘Matryoshka’ variant) that base64-decodes, gunzips, and evals an inner AppleScript payload written to a temporary staging directory such as /tmp/xdivcmp/, /tmp/lovemrtrump/, or /tmp/osalogging/. The AppleScript is invoked through osascript and immediately displays a non-closable dialog that mimics a legitimate ‘System Preferences’ authentication prompt. Password candidates are validated in real time against macOS Directory Services using ‘do shell script … with administrator privileges’ or a dscl authentication call, so only a real login password closes the dialog. Once the cleartext password is captured, the stealer runs with admin rights and begins parallel collection.
Harvesting is extensive. The stealer enumerates 12 Chromium-based browsers (Chrome, Chrome Beta, Chrome Canary, Chrome Dev, Edge, Brave, Vivaldi, Opera, Opera GX, Chromium, Arc, CocCoc) and 2 Firefox-based browsers (Firefox, Waterfox), copying Cookies, Login Data, Web Data, IndexedDB, and Local Extension Settings for 200+ password-manager, 2FA, and wallet extensions (LastPass, 1Password, Dashlane, Bitwarden, MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Authy, Google Authenticator). It exfiltrates login.keychain-db (AES-256 encrypted, decrypted offline using the captured password) and 16 standalone desktop wallets including Exodus, Atomic, Electrum, Coinomi, Guarda, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Monero, Wasabi, Sparrow, Electron Cash, and Electrum-LTC. In the Matryoshka variant the loader surgically patches /Applications/Ledger Live.app/Contents/Resources/app.asar and re-signs the Electron bundle locally, while Trezor Suite is killed, removed, and replaced with a malicious trojanized build pulled from C2.
Collected artefacts are zipped to /tmp/out.zip or /tmp/osalogging.zip and POSTed to the C2 using either plain HTTP (e.g. http://172.94.9.250, http://45.135.232.33/log) or an API-key-gated endpoint that returns 404 without the correct ‘api-key: 5190ef17…’ header. Hunt.io’s infrastructure mapping connects the campaign to a cluster of at least nine C2 servers (45.146.130.129, 5.199.166.102, 185.39.206.183, 45.135.232.33, 88.214.50.3, 194.26.29.217, 83.222.190.214, 185.147.124.212, 188.92.28.186) running OpenSSH 9.2p1 on port 22, phishing pages on 80, a hidden admin panel on 3333, and iperf3 on 5201 — likely a Russian-speaking MaaS crew overlapping with Odyssey Stealer and Atomic Stealer affiliates.
Jamf Threat Labs disclosed a parallel variant on April 8, 2
Weaknesses (CWE)
CWE-1021, CWE-20, CWE-285, CWE-346, CWE-829
Target sectors: cryptocurrency, financial, technology, media, consumer, creative_services, developers, web3
Target regions: North America, Europe, Asia-Pacific, Latin America
Detections & IOCs
As of 2026-07-28, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 66 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589, T1583, T1583, T1587, T1566, T1189, T1204, T1059, T1059, T1559