The latest SHub macOS infostealer variant abandons Terminal-based ClickFix tactics for AppleScript execution, using fake Apple, Google, and Microsoft branding to steal credentials, crypto wallets, and ...

Jamf Threat Labs has discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal ...

Jamf finds a ClickFix variant that swaps copy-paste Terminal lures for Script Editor execution, tightening delivery of Atomic Stealer. ClickFix malware campaigns are evolving again, with threat actors ...