A new attack campaign uses the Script Editor app to deliver Atomic Stealer malware to macOS users. This is a variation of the ClickFix attack, which previously tricked users into running commands directly in the Terminal.

Script Editor, a standard macOS app, allows users to create and execute scripts using AppleScript and JXA. It’s considered a trustworthy app native to macOS.

While Script Editor has been used for malware distribution before, researchers point out that this ClickFix method doesn’t require victims to manually enter commands in Terminal, making it more seamless.

While the Terminal-based method was broadly talked about, macOS Tahoe 26.4 included protection against ClickFix attacks by showing a warning when commands are executed.

In a recent Atomic Stealer distribution campaign, observed by Jamf security researchers, attackers are using fake Apple-like websites that appear to provide help for freeing up disk space on Macs.

These websites present what looks like genuine system cleanup instructions, but utilize the applescript:// URL scheme to automatically open Script Editor with malicious code already loaded.

The harmful code launches an encoded ‘curl | zsh’ command, which downloads and runs a script directly in the computer’s memory.

This process decodes a base64 + gzip-encoded set of instructions, downloads a file called ‘/tmp/helper’, removes security limitations with ‘xattr -c’, allows the file to be executed, and then executes it.

The end result is the installation of a Mach-O binary identified as Atomic Stealer (AMOS). Atomic Stealer is a readily available malware sold as a service and has been widely spread in ClickFix scams over the last year, using different disguises.

The malware aims to steal a wide range of sensitive information, including data from the Keychain, desktop, cryptocurrency wallet extensions in browsers, browser autofill data, passwords, cookies, stored credit card details, and system specifics.

In the past year, AMOS was equipped with a backdoor, allowing attackers to maintain persistent access to infected systems.

Mac users should be extra cautious with Script Editor prompts and avoid running them unless they completely understand what they do and trust the origin.

When looking for macOS troubleshooting information, it’s best to rely only on the official documentation provided by Apple itself.

Apple Support Communities is an online forum where Apple users can assist one another with advice; however, it may not be completely safe.