New ClickFix Variant Targets macOS with Fake Apple Page

Security researchers have identified a new variant of the ClickFix malware campaign targeting macOS users, which tricks victims into installing the Atomic Stealer infostealer through a fake Apple-themed webpage rather than the traditional Terminal application. The attack, first detailed this week, exploits the built-in Script Editor app to bypass recent Apple security enhancements, potentially exposing users' sensitive data on devices running macOS versions including Tahoe and later.

In this evolved technique, users encounter a webpage mimicking an official Apple support page titled "Reclaim disk space on your Mac." The site presents step-by-step instructions for freeing up storage, a common lure in ClickFix operations that rely on social engineering to convince people to execute harmful code under the pretense of routine maintenance. When users click an "Execute" button, the browser triggers an applescript URL scheme, prompting permission to open Script Editor, a default macOS tool for creating and running scripts.

If approved, Script Editor launches with a prefilled script that appears to perform legitimate cleanup tasks. In reality, the code runs an obfuscated shell command...