macOS ClickFix Bypass Uses Script Editor to Evade Terminal Warnings
macOS defenses that warn users about suspicious Terminal commands can be bypassed by abusing Script Editor, a trusted preinstalled app, to run malicious commands without explicit Terminal interaction. This breaks the assumption that Terminal-based warnings cover all ClickFix attack paths and means standard detection methods miss this delivery vector.
Jamf observed active delivery of Atomic Stealer malware through fake Apple-themed disk-cleanup web pages that use an applescript:// link to open Script Editor with a prefilled malicious script. This script runs obfuscated commands that download and execute the malware entirely in memory, avoiding Terminal prompts and user-typed shell commands. The attack targets any Mac user who follows these web-based cleanup instructions, leveraging a legitimate macOS app as the execution channel.
This campaign shows that ClickFix mitigations focused on Terminal execution warnings are insufficient because attackers can use trusted macOS apps like Script Editor to run harmful commands. The risk persists until controls address this broader execution path, especially in environments relying on user prompts and Terminal-based detection.