ClickFix on macOS: How Apple Users Are Being Scammed

Summary

ClickFix is a social engineering technique that entices a victim to type or paste a malicious command in their terminal. On macOS systems that has become a primary initial access vector for infostealers. This resource is our macOS-specific analysis; we also published a general ClickFix write-up covering the Windows/PowerShell variant.

Why ClickFix works

ClickFix works by getting the victim to type or paste a malicious command themselves, so no file ever gets downloaded. That matters because every one of macOS’s built-in defences (Gatekeeper, which blocks apps from unidentified developers; notarization, Apple’s malware scan for apps distributed outside the App Store; and the quarantine warning you get the first time you open something downloaded from the internet) only triggers when a file is downloaded and opened. A lure page silently copies a malicious command to the clipboard, then tells the victim to paste it into Terminal as a CAPTCHA check or software fix. The user is the delivery mechanism, so there’s nothing to scan or flag.

Apple’s macOS 26.4 Terminal paste-confirmation prompt was meant to stop this, and held for a matter of weeks. Current campaigns route around it via the applescript:// URI handler, which opens Script Editor with the code prefilled instead, a path the prompt doesn’t cover.

Two active macOS campaigns

AMOS (Atomic macOS Stealer)

Unit42’s 16 September 2026 analysis traces a fresh AMOS infection from a fake “macOS toolkit” site. Each stage decodes and runs the next in memory, leaving little static for a signature to catch, until a fake osascript password dialog requests “administrator privileges” through a genuine macOS system auth prompt. That’s what makes it convincing: the dialog is real, only the reason for it is fake.

Stage	What happens
Delivery	Pasted command fetches a Zsh script over HTTPS
Decode	Script is base64 and gzip encoded; decodes in memory to a second Zsh script
Payload	Second script fetches a Mach-O binary, dropped as /tmp/helper
Persistence	Plist at /tmp/starter points to two LaunchAgents disguised as system processes
Credential theft	osascript dialog requests “administrator privileges” (real system prompt)
TCC abuse	Requests access to Finder, Desktop, Documents, Notes
Exfiltration	Browser data, crypto wallets, AWS/gcloud credentials, Telegram data, Zsh history sent to C2 over HTTP POST

ClickLock

Group-IB’s September 2026 report covers the most significant new macOS ClickFix payload to surface recently: a modular stealer with zero VirusTotal detections at analysis time, over 100 victims across 33 countries, active since roughly May 2026. Two things set it apart from AMOS.

Its password dialog is fake, not a real system prompt, built with osascript and hidden answer to mask input as dots, then validated locally with dscl -authonly, the same call macOS itself uses to check a login password. And it coerces compliance: a loop kills Finder, Dock, Terminal, and most other visible apps every 200 milliseconds until the victim enters their password, making the machine unusable in the meantime.

Component	Behaviour
Fake password dialog	osascript display dialog with hidden answer, styled with a downloaded Apple icon
Password validation	dscl /Local/Default -authonly, checked locally before exfiltration
UI coercion	Kills Finder, Dock, SystemUIServer, browsers, Terminal every 200ms, for up to 34.7 days
Alert suppression	Kills NotificationCenter continuously for ~6 hours
Exfiltration	Telegram Bot API
Backdoor	gs-netcat (GSocket) disguised as an iCloud process, survives after other components self-delete

Detection opportunities

Since ClickFix never downloads a file, download-based controls have nothing to catch. Detection has to come from watching what actually happens on the box after the paste: the process tree, the file system, the clipboard, and DNS. These are live detections in SensorZero’s Endpoint Sensor today:

What’s happening on the machine	Technical signal	Log source
Victim pastes the command into Terminal	pbpaste or clipboard content piped into sh/bash/zsh	Process creation
Attacker uses Script Editor to dodge the Terminal paste prompt	gzip/base64/curl pattern in a command line, matching the applescript:// bypass	Process creation
Malware mounts a disk image without showing a Finder window	hdiutil attach -nobrowse, or a binary running straight from /Volumes/	Process creation
Malware strips the download warning off a file	xattr -d com.apple.quarantine outside /Applications/	Process creation
A fake or real password prompt tries to capture credentials	AMOS’s real dialog (administrator privileges) or ClickLock’s spoofed one (hidden answer)	Process creation
Malware checks whether a captured password is actually correct	dscl -authonly called from a non-system process, which has essentially no legitimate use	Process creation
Malware sets itself to run again on every login	LaunchAgents with Apple-masquerading labels, or loaded from user-writable paths	Process creation, file creation
Malware reads saved browser passwords out of Keychain	security CLI touching Chrome Safe Storage	Process creation
A hidden remote-access channel gets installed	gs-netcat (GSocket) execution	Process creation
Stolen data leaves the machine	Resolution of Telegram’s Bot API domain	DNS query

None of this relies on having seen AMOS or ClickLock specifically before; it catches the behaviour any ClickFix payload has to show on macOS. SensorZero is Eviant’s intel-driven, agentic threat detection and response platform, built to catch exactly this kind of activity on macOS endpoints as it happens.

What to actually do about it

No legitimate site, update notifier, or CAPTCHA will ever ask you to open Terminal and paste something. For your business, that awareness has to be backed by effective SIEM detections built to keep pace with a changing ClickFix landscape. Apple and security vendors keep shipping reactive controls to close individual gaps, like the macOS 26.4 Terminal paste prompt, but each one gets bypassed within weeks and doesn’t remove the need for detection. As the technique keeps evolving, logging and detection and response stay fundamental to identifying new variants early and remain a core part of any defense in depth strategy.

Related reading: our general ClickFix breakdown covers the Windows/PowerShell side of this technique, and our infostealer piece goes into what happens to credentials and session cookies once a stealer like AMOS gets them.

---

This analysis draws on SensorZero threat intelligence research covering the last 90 days of macOS ClickFix reporting, cross-referenced against SensorZero’s own macOS detection coverage. If you’re running a Mac fleet and want to know what your current tooling would actually catch here, get in touch.