ClickFix-Style macOS Attack Uses Script Editor to Deliver Atomic Stealer
Summary
A reported ClickFix-style macOS campaign uses an Apple-themed webpage and applescript:// workflow to launch an obfuscated script in Script Editor, download a Mach-O binary, and run an Atomic Stealer variant.
Key points
- The reported attack replaces Terminal-based command execution with a browser-triggered applescript:// workflow that opens a pre-filled script in macOS Script Editor.
- The webpage presents the script as a cleanup tool, but it contains an obfuscated shell command that decodes a URL using tr.
- The command uses curl -k to retrieve content and pipes it to zsh for in-memory execution.
- A second-stage script downloads a Mach-O binary to /tmp, removes extended attributes, sets execution permissions, and runs it.
- Researchers identified the final payload as a variant of Atomic Stealer.
- Reported indicators include dryvecar[.]com, storage-fixes.squarespace[.]com, cleanupmac.mssg[.]me, and a helper-file SHA-256 hash: 3d3c91ee762668c85b74859e4d09a2adfd34841694493b82659fda77fe0c2c44.
Article Details
- Attack Vectors
- An Apple-themed webpage prompts users to click “Execute,” triggering an applescript:// workflow that opens a pre-filled script in macOS Script Editor.
- The script uses string manipulation with tr to decode a URL, then uses curl -k to retrieve content and pipes it to zsh for execution.
- A second-stage script uses base64 encoding and gzip compression, downloads a Mach-O binary to /tmp, removes extended attributes, grants execution permissions, and runs it.
- Defensive Notes
- The article identifies dryvecar[.]com, storage-fixes.squarespace[.]com, cleanupmac.mssg[.]me, and the SHA256 hash of helper as detection indicators.
- The article reports that macOS 26.4 adds safeguards, including scanning pasted commands and warning users about scripts from unidentified developers; it also notes that users can still proceed through the prompts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | cleanupmac[.]mssg[.]me | Malicious webpage identified by the article as part of the attack. |
| DOMAIN | dryvecar[.]com | Domain linked by the article to the infostealer payload. |
| DOMAIN | storage-fixes[.]squarespace[.]com | Malicious webpage identified by the article as part of the attack. |
| SHA256 | 3d3c91ee762668c85b74859e4d09a2adfd34841694493b82659fda77fe0c2c44 | SHA256 of the helper Mach-O executable identified as an attack indicator. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationThe initial command hides a URL using string manipulation, and the second-stage payload is further obfuscated with base64 encoding and gzip compression.T1059.004 · Unix ShellThe obfuscated command retrieves content with curl -k and pipes it to zsh for execution.T1105 · Ingress Tool TransferThe scripts use curl and a second-stage download to retrieve remote content and a Mach-O binary.T1204.001 · Malicious LinkThe webpage prompts the user to click “Execute,” initiating the applescript:// workflow used to present the script.T1222.002 · Linux and Mac PermissionsThe second-stage script assigns execution permissions to the downloaded Mach-O binary before running it.
Malware
Vendors
Products
macOSA newly observed ClickFix-style macOS attack replaces Terminal-based execution with macOS Script Editor and a browser-triggered applescript:// workflow to evade Terminal-focused defenses.Script EditorA newly observed ClickFix-style macOS attack replaces Terminal-based execution with macOS Script Editor and a browser-triggered applescript:// workflow to evade Terminal-focused defenses.