# Meow Mac Stealer RAT: macOS ClickFix Lures Deploy AppleScript Infostealer with Persistent RAT Capabilities

> Netskope Threat Labs is tracking a ClickFix social-engineering campaign that delivers an AppleScript-based infostealer-turned-RAT to macOS users. Victims are tricked into pasting a base64-encoded command into Terminal; the payload harvests keychain contents, live session cookies from 12 browsers and 200+ extensions, and 16 desktop cryptocurrency wallets, then establishes LaunchAgent persistence and polls a hard-coded C2 (qwqerrqwr2145qw.com) for commands to execute at runtime.

- **Published:** 2026-06-17T00:00:00Z
- **Last reviewed:** 2026-06-17T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0842
- **ID:** TL-2026-0842
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 34 (full data via the Threadlinqs MCP server — Purple tier)

## Description

In April 2026, Netskope Threat Labs reported a ClickFix campaign delivering an AppleScript-based infostealer to macOS users via a persistent fake system dialog. Through continuous monitoring, Netskope intercepted a new, upgraded campaign that emerged on May 31, 2026, which escalates the threat from a simple stealer to a full-featured remote access trojan (tracked as the "Meow Mac stealer RAT").

The initial access vector is ClickFix: a deceptive social-engineering / dropper page (fake macOS app-store, software-update, or crypto-news themed sites) filters visitors by user agent and instructs macOS victims to copy a command and paste it into Terminal. The command is typically a base64-encoded shell stub of the form `echo '<BASE64>' | base64 -d | bash`, which decodes and executes a shell loader that retrieves an AppleScript payload (e.g. /debug/payload.applescript) from the C2.

The AppleScript stage deploys a closeless fake system dialog that mimics a legitimate macOS software-update / password prompt. The dialog has no close button and abuses macOS Directory Services to validate the entered password in real time; if the password is wrong the dialog immediately reappears, holding the UI hostage until a valid credential is supplied. The captured password is then used to unlock and dump the login Keychain.

Collection prioritizes live session cookies (to bypass MFA via session hijacking) from 12 browsers and over 200 browser extensions, browser autofill/credential stores, password-manager vault data, the macOS Keychain, and 16 standalone desktop cryptocurrency wallet applications (Exodus, Atomic, Electrum, Coinomi, Guarda, Ledger Live, Trezor Suite, Bitcoin Core, and others), with the malware requesting wallet-specific asar payloads (exodus-asar, atomic-asar, ledger-asar, ledgerlive-asar, trezor-asar) from the C2. Stolen data is staged under /tmp/ (e.g. /tmp/xdivcmp/), archived with the macOS `ditto` utility, and exfiltrated via HTTP POST to a hard-coded C2 gate. Post-exfiltration the malware deletes its files and overwrites disk sectors to frustrate forensics, and strips the com.apple.quarantine attribute to evade Gatekeeper.

Persistence is achieved through a masqueraded LaunchAgent disguised as a legitimate software-update component. The RAT then periodically polls the C2 (heartbeat / event endpoints) for operator instructions that are executed at runtime, giving the actor durable remote command execution on the host. Language artifacts in the source code of the attacker's dropper websites point to a Russian-speaking threat actor.

## MITRE ATT&CK

- T1566 Phishing
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.001 Launch Agent
- T1553.001 Gatekeeper Bypass
- T1027 Obfuscated Files or Information
- T1036 Masquerading
- T1070.004 File Deletion
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1555.005 Password Managers
- T1539 Steal Web Session Cookie
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility
- T1071.001 Web Protocols
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1550.004 Web Session Cookie
- T1561 Disk Wipe

## Sources

- [macOS ClickFix Lures Deploy AppleScript Stealer with Persistent RAT (Netskope Threat Labs)](https://www.netskope.com/blog/macos-clickfix-lures-deploy-applescript-stealer-persistent-rat)
- [Netskope Threat Labs IOCs - Meow-macOS (Meow Mac stealer RAT)](https://github.com/netskopeoss/NetskopeThreatLabsIOCs/tree/main/Malware/Meow-macOS)
- [macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections (Netskope)](https://www.netskope.com/blog/macos-clickfix-campaign-applescript-stealers-new-terminal-protections)
- [macOS ClickFix Uses AppleScript Stealers (SOC Prime)](https://socprime.com/active-threats/macos-clickfix-uses-applescript-stealers/)
- [Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure (Hunt.io)](https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers (Microsoft Security Blog)](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [macOS ClickFix attacks deliver AppleScript stealers (The Register)](https://www.theregister.com/2026/04/21/macos_clickfix_attacks_deliver_applescript/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0842