ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer

Reported 08 Apr 2026 by otx · Severity: medium

Jamf Threat Labs discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal entirely.