Atomic Stealer Evades macOS ClickFix Protections via Script Editor Abuse

A new Atomic Stealer campaign bypasses macOS Tahoe’s ClickFix terminal warnings by pivoting to Script Editor instead. Attackers drive victims to fake Apple-branded disk-cleanup sites that use the applescript:// URL scheme to open Script Editor pre-loaded with malicious code - no Terminal interaction required. The payload chain runs a curl | zsh command in memory, decodes a base64+gzip blob, drops a Mach-O binary to /tmp, strips its quarantine attributes with xattr -c, and executes it.

The final payload is Atomic Stealer (AMOS), a commodity MaaS tool that harvests Keychain secrets, browser credentials, cookies, saved cards, and crypto wallet extensions. A backdoor component added last year also gives operators persistent footholds on compromised machines.

The technique is significant because Apple’s macOS Tahoe 26.4 specifically added friction around Terminal-based ClickFix execution - this variant sidesteps that control entirely by using a trusted, pre-installed system application. Users should treat any unsolicited Script Editor prompt the same way they would an unexpected sudo request: as hostile by default.