ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer
Essential information
- Published
- 08/04/2026 16:49
- Modified
- 08/04/2026 16:31
- Source / Author
- AlienVault
- Confidence
- 100/100
- Report type(s)
- threat-report
- Labels / Tags
- applescript atomicstealer clickfix infostealer macos
- Tags
- 2026-04-08 applescript atomicstealer clickfix infostealer macos
- Related entities
- 5 indicators, 5 observables, 1 techniques (mitre), 2 malware, 1 others
Description
Jamf Threat Labs discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal entirely.