ClickFix macOS, Script Editor bypasses the Terminal warning
Apple added an anti-ClickFix warning in the Terminal with macOS 26.4. Attackers promptly switched to Script Editor to distribute Atomic Stealer without friction.
Apple sneaked an anti-ClickFix warning into the Terminal with macOS Tahoe 26.4. Atomic Stealer operators circumvented the block in days by using another pre-installed app, Script Editor, which no one was watching. The campaign was reported on April 8, but the scale is unknown.
What’s happening
Jamf Threat Labs published on April 8, 2026, an analysis of a macOS variant of the ClickFix attack.
The trap: a page with Apple colors, often a fake guide for “freeing up disk space on your Mac.”
The twist: the vector. Instead of a command to paste into the Terminal, the page contains a link in applescript:// format.
The link opens Script Editor with a pre-filled AppleScript code. A click on Run, and an obscured curl | zsh executes in memory. The binary placed in /tmp/helper is Atomic Stealer, alias AMOS.
The circumvention targets macOS Tahoe 26.4. Since this version, pasting a command into the Terminal triggers a warning. Script Editor, however, doesn’t have this filter.
New variant detected, same malware (April 12)
This second campaign doesn’t use Script Editor. The vector is different, the payload identical.
Paolo Galeone documented on April 12, 2026, a second campaign delivering Atomic Stealer, with no visible manipulation.
No fake “resolve an error” page. No rigged captcha. Just a sponsored Google Ads announcement, top position on the “how to clean up space on macOS” search. The link leads to a fake disk cleaner landing page with perfect Apple design. Nothing alarming on the surface.
Two techniques you’ve probably never seen
First trap, the download link behaves differently depending on who’s asking.
Open the URL in Safari? You get a 404 error, nothing to see here. But the script embedded in the page calls the same URL via curl. The server returns 200 and delivers the binary. The idea: make the download link invisible to anyone trying to “verify before executing.” You can’t open the URL in your browser to see what’s inside.
Second trap, the malware gets rid of Gatekeeper before executing.
After downloading to /tmp/helper, the script executes xattr -c /tmp/helper. xattr is a legitimate macOS tool that manages extended file attributes. The com.apple.quarantine attribute is what Gatekeeper uses to know a file came from the internet. xattr -c removes it in one go. When the binary launches, Gatekeeper sees nothing unusual: no quarantine marker, no warning, no blocking.
The delivered binary is a universal fat Mach-O binary, x86_64 and arm64, running on Intel and Apple Silicon. The associated C2 domain for this campaign is dryvecar.com.
Why this matters to you
ClickFix makes the attacker look like tech support. A fake error, a fake captcha, instructions to “fix” the problem by pasting something.
So far on Mac, it’s been a Terminal command. The dark window opens, you can still ask yourself a question.
Script Editor changes the game. A notepad with syntax highlighting, no mental alarm goes off.
Once Atomic Stealer is launched, you lose your keychain and browsers. Session cookies, direct access to your accounts without passwords. Crypto wallets drained if recovery phrases are in the extension. Saved credentials, open door to all services.
What you need to do
→ Immediately: never click on an applescript:// link from an unknown site. If Script Editor opens spontaneously with pre-filled code, close the window without reading the code.
→ Also immediately: if a web page or script asks you to paste or run a command containing xattr -c, stop everything. That’s an attempt to remove Gatekeeper protection. No legitimate app needs you to do that.
→ Within the week: check the Opening Items in System Preferences > General > Opening Items, remove anything that looks unfamiliar.
If you have serious doubts, KnockKnock from Objective-See lists persistent launch executables, for free.
→ If you want to go further: