Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities
Meow Mac Stealer RAT (TL-2026-0842), also tracked as Meow Mac stealer RAT, is a high-severity malware campaign, first published 2026-06-17. It has no confirmed attribution, affects Apple macOS, maps to 22 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 34 indicators of compromise.
Key facts for TL-2026-0842
- Threat ID
- TL-2026-0842
- Also known as
- Meow Mac stealer RAT, macOS ClickFix AppleScript Stealer
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- 2026-06-17
- Last reviewed
- 2026-06-17
- Attribution confidence
- NONE
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, technology, financial, consumer
- Target regions
- Global, North America, Europe
- Detection rules
- 9
- Indicators of compromise
- 34
Malware and tooling in Meow Mac Stealer RAT
Malware and tooling: 15c1f07222c4441a0251e05d241ee3ef6697db7fa5ea8eaa64ef51e174e945b6, 948be3ba885ea945acc4f42867be0298b5285ce245b6c787d56a3b798c40a236
Netskope Threat Labs is tracking a ClickFix social-engineering campaign that delivers an AppleScript-based infostealer-turned-RAT to macOS users. Victims are tricked into pasting a base64-encoded command into Terminal; the payload harvests keychain contents, live session cookies from 12 browsers and 200+ extensions, and 16 desktop cryptocurrency wallets, then establishes LaunchAgent persistence and polls a hard-coded C2 (qwqerrqwr2145qw.com) for commands to execute at runtime.
How Meow Mac Stealer RAT works
In April 2026, Netskope Threat Labs reported a ClickFix campaign delivering an AppleScript-based infostealer to macOS users via a persistent fake system dialog. Through continuous monitoring, Netskope intercepted a new, upgraded campaign that emerged on May 31, 2026, which escalates the threat from a simple stealer to a full-featured remote access trojan (tracked as the "Meow Mac stealer RAT").
The initial access vector is ClickFix: a deceptive social-engineering / dropper page (fake macOS app-store, software-update, or crypto-news themed sites) filters visitors by user agent and instructs macOS victims to copy a command and paste it into Terminal. The command is typically a base64-encoded shell stub of the form `echo '<BASE64>' | base64 -d | bash`, which decodes and executes a shell loader that retrieves an AppleScript payload (e.g. /debug/payload.applescript) from the C2.
The AppleScript stage deploys a closeless fake system dialog that mimics a legitimate macOS software-update / password prompt. The dialog has no close button and abuses macOS Directory Services to validate the entered password in real time; if the password is wrong the dialog immediately reappears, holding the UI hostage until a valid credential is supplied. The captured password is then used to unlock and dump the login Keychain.
Collection prioritizes live session cookies (to bypass MFA via session hijacking) from 12 browsers and over 200 browser extensions, browser autofill/credential stores, password-manager vault data, the macOS Keychain, and 16 standalone desktop cryptocurrency wallet applications (Exodus, Atomic, Electrum, Coinomi, Guarda, Ledger Live, Trezor Suite, Bitcoin Core, and others), with the malware requesting wallet-specific asar payloads (exodus-asar, atomic-asar, ledger-asar, ledgerlive-asar, trezor-asar) from the C2. Stolen data is staged under /tmp/ (e.g. /tmp/xdivcmp/), archived with the macOS `ditto` utility, and exfiltrated via HTTP POST to a hard-coded C2 gate. Post-exfiltration the malware deletes its files and overwrites disk sectors to frustrate forensics, and strips the com.apple.quarantine attribute to evade Gatekeeper.
Persistence is achieved through a masqueraded LaunchAgent disguised as a legitimate software-update component. The RAT then periodically polls the C2 (heartbeat / event endpoints) for operator instructions that are executed at runtime, giving the actor durable remote command execution on the host. Language artifacts in the source code of the attacker's dropper websites point to a Russian-speaking threat actor.
MITRE ATT&CK techniques used in TL-2026-0842
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070.004 File Deletion
Exfiltration
T1041 Exfiltration Over C2 Channel
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers; T1555.005 Password Managers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste
Command and Control
T1071.001 Web Protocols; T1105 Ingress Tool Transfer
Discovery
T1217 Browser Information Discovery
Persistence
Lateral Movement
defense-impairment
Impact
Initial Access
Affected products and versions in Meow Mac Stealer RAT
- Apple — macOS
Vulnerable versions: macOS (pre-Tahoe 26.4 Terminal paste protections)
Fixed in: macOS Tahoe 26.4; current macOS Sequoia with paste warnings
Remediation for Meow Mac Stealer RAT
Patches
- Update to macOS Tahoe 26.4 or current macOS Sequoia to gain Terminal paste-warning protections
Immediate actions
- Block the C2 domain qwqerrqwr2145qw.com and all listed dropper domains at DNS/proxy/firewall
- Hunt for and remove malicious LaunchAgents under ~/Library/LaunchAgents masquerading as software updates
- Force-rotate credentials and revoke all active browser/web sessions for any user who pasted a Terminal command from a prompt
- Search endpoints for staging artifacts under /tmp (e.g. /tmp/xdivcmp/) and base64|bash execution in shell history
Workarounds
- Disable or restrict clipboard paste into Terminal; alert on Terminal launched immediately after browser activity
- Block outbound HTTP POST to newly registered or low-reputation domains
Longer-term hardening
- Deploy macOS EDR with behavioral detection for AppleScript dialogs, osascript spawning Terminal, and Directory Services password validation
- Enforce phishing-resistant MFA (FIDO2/passkeys) to blunt session-cookie theft
- Restrict execution of unsigned AppleScript and monitor LaunchAgent creation
- User awareness training on ClickFix / copy-paste-to-Terminal social engineering
Timeline of Meow Mac Stealer RAT
- ClickFix copy-paste-to-execute social-engineering technique emerges in the wild on Windows before being ported cross-platform (context).
- Public reporting (The Register, Hunt.io, SOC Prime) details macOS ClickFix campaigns delivering AppleScript stealers and maps their C2 / dropper infrastructure.
- Netskope Threat Labs reports the initial ClickFix campaign delivering an AppleScript-based infostealer to macOS via a persistent fake system dialog, and notes new macOS Terminal paste-warning protections.
- Microsoft Security details a ClickFix campaign using fake macOS utility lures to deliver infostealers, confirming the technique's expansion from Windows to macOS.
- Netskope intercepts a new, upgraded campaign that escalates the threat from a simple stealer to a full-featured remote access trojan (Meow Mac stealer RAT) via continuous monitoring of the actor's infrastructure.
- Analysis confirms RAT capabilities beyond theft: LaunchAgent persistence, runtime C2 polling for operator commands, and anti-forensics (file deletion, disk-sector overwrite, quarantine-attribute stripping).
- Language artifacts in the source code of the attacker's dropper websites point to a Russian-speaking, financially motivated threat actor (LOW confidence).
- Netskope Threat Labs publishes analysis and IOCs for the Meow Mac stealer RAT (C2 qwqerrqwr2145qw.com, sample hashes, dropper domains) to the NetskopeThreatLabsIOCs repository.
Sources cited for Meow Mac Stealer RAT
- macOS ClickFix Lures Deploy AppleScript Stealer with Persistent RAT (Netskope Threat Labs)
- Netskope Threat Labs IOCs - Meow-macOS (Meow Mac stealer RAT)
- macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections (Netskope)
- macOS ClickFix Uses AppleScript Stealers (SOC Prime)
- Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure (Hunt.io)
- ClickFix campaign uses fake macOS utilities lures to deliver infostealers (Microsoft Security Blog)
- macOS ClickFix attacks deliver AppleScript stealers (The Register)
Threats related to Meow Mac Stealer RAT
- ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data
- macOS ClickFix Campaign Silently Mounts Malicious DMGs (hdiutil attach -nobrowse) to Deploy Atomic macOS Stealer (AMOS)
- Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and MacSync Campaign
- ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs to Coerce Credentials
- macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync Infostealers
- Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware
Detection coverage for TL-2026-0842
As of 2026-06-17, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-0842 across Splunk SPL, Microsoft KQL and Sigma, covering 34 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-0842
3 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.