ClickFix Finds a New Way to Infect Macs
ClickFix attackers have adapted their Mac infections by moving away from Terminal commands and instead using the applescript:// URL scheme to open Script Editor with a preloaded script that looks like a harmless cleanup tool.
The fake lure promises to reclaim disk space and even shows a bogus message saying storage was freed, while the script actually pulls down more code and installs Atomic Stealer — a macOS info-stealing malware.
This approach still depends on tricking users into approving the actions themselves, which is why the attack works even without obvious scary commands.
ClickFix was reportedly behind more than half of malware loader activity in 2025 and keeps evolving its methods to avoid user suspicion and security detection.
How to Stay Safe
- Slow down before acting on any prompt or instruction from a website.
- Avoid running scripts or commands from untrusted websites.
- Verify instructions independently before following them.
- Keep your Mac and security tools fully up to date.
