ClickFix Malware Bypasses macOS Security via Script Editor

Cyber Threat Intelligence has highlighted a concerning new tactic employed by the ClickFix malware campaign targeting macOS users. Previously, these campaigns leveraged the Terminal application to execute malicious commands, often encountering built-in macOS warnings designed to prevent users from pasting potentially harmful scripts. However, ClickFix has evolved, now utilizing the macOS Script Editor application as an alternative vector to circumvent these protections.

This shift is significant because Script Editor, a legitimate application for creating and running AppleScripts, may not trigger the same security alerts as direct Terminal command pasting. This allows ClickFix to potentially execute its payload more stealthily, posing a renewed threat to Mac users who might not be as vigilant when interacting with Script Editor compared to the Terminal. The malware aims to compromise systems by tricking users into running malicious code disguised as legitimate scripts.