Full Report
A new campaign delivering the Atomic Stealer malware to macOS users abuses the Script Editor in a variation of the ClickFix attack that tricked users into executing commands in Terminal. [...]
Analysis Summary
# Morning News Roll-up April 8, 2026
## Overview
Today's intelligence highlights a sophisticated evolution in macOS-targeted social engineering. Threat actors are now bypassing recent macOS Terminal security warnings by leveraging the built-in Script Editor to deliver the Atomic Stealer (AMOS) malware. This "ClickFix" variation demonstrates the persistent adaptability of commodity malware-as-a-service operators.
## Top Stories
### New macOS stealer campaign uses Script Editor in ClickFix attack
- Summary: A new Atomic Stealer campaign utilizes the `applescript://` URL scheme to trick users into opening the macOS Script Editor. This method bypasses new Terminal protections in macOS Tahoe 26.4, executing obfuscated shell commands to deploy information-stealing malware.
- Source: hxxps://www[.]bleepingcomputer[.]com/news/security/new-macos-stealer-campaign-uses-script-editor-in-clickfix-attack/
---
# Script Editor Abuse in macOS ClickFix Campaigns
## Key Points
- **Shift in Tactics**: Threat actors have transitioned from Terminal-based "ClickFix" attacks to abusing the **Script Editor** application via the `applescript://` URL protocol.
- **Bypassing Protections**: This method bypasses the specific warnings Apple recently introduced in macOS Tahoe 26.4 for Terminal-based command execution.
- **Trusted Application Abuse**: Script Editor is a legitimate, pre-installed macOS utility, making its execution appear less suspicious to the user and some security tools.
- **Memory Execution**: The attack uses a `curl | zsh` command string to download and execute scripts directly in system memory to evade disk-based detection.
## Threat Actors
- **Attribution**: Distributed via Malware-as-a-Service (MaaS) channels.
- **Associated Groups**: Operators of **Atomic Stealer (AMOS)**.
- **Motivations**: Financial gain through the theft of credentials, cryptocurrency, and sensitive personal data.
## TTPs
- **Social Engineering (ClickFix)**: Using fake Apple-themed websites with lures such as "reclaiming disk space" to trick users into clicking malicious links.
- **Protocol Association**: Using `applescript://` to trigger the automatic opening of the Script Editor with pre-filled malicious code.
- **Command Execution**: Leveraging `zsh` and `curl` to fetch remote payloads.
- **Evasion**: Using `xattr -c` to remove the "com.apple.quarantine" attribute from downloaded binaries to bypass Gatekeeper.
- **Obfuscation**: Use of Base64 encoding and Gzip compression for secondary stage payloads.
- **MITRE ATT&CK**:
- T1204.001 (User Execution: Malicious Link)
- T1059.002 (Command and Scripting Interpreter: AppleScript)
- T1140 (Deceptive File Execution/Deobfuscate/Decode Files or Information)
## Affected Systems
- **Platform**: macOS (specifically versions including and post-Tahoe 26.4).
- **Scope**: Any macOS user targeted by Apple-themed social engineering lures.
- **Targeted Data**: Keychain data, Browser Autofill, Passwords, Cookies, Credit Card info, and over 50 Cryptocurrency wallet extensions.
## IoCs
- **Payload Path**: `/tmp/helper`
- **Malware Variant**: Atomic Stealer (AMOS) Mach-O binary
- **URL Scheme**: `applescript://`
- **Associated URL**: hxxps://www[.]jamf[.]com/blog/clickfix-macos-script-editor-atomic-stealer/ (Reference Source)
## Mitigations
- **User Education**: Train users to treat any browser-initiated prompt to open "Script Editor" as a high-risk event.
- **Official Documentation**: Advise users to only follow troubleshooting steps from official support[.]apple[.]com domains.
- **Endpoint Security**: Deploy EDR solutions capable of monitoring `osascript` or `Script Editor` execution, especially when spawned by browser processes.
- **System Hardening**: Restrict the execution of unsigned binaries or those with cleared extended attributes in high-security environments.
## Conclusion
This campaign represents a tactical refinement in macOS malware delivery. By pivoting from the Terminal to the Script Editor, attackers have neutralized recent OS-level warnings. The threat assessment remains **High** for macOS users, as the Atomic Stealer payload is highly effective at harvesting sensitive credentials. Organizations should focus on detecting the abuse of AppleScript protocols and educating users on the risks of browser-based system "repair" prompts.