Jamf Threat Labs documented a ClickFix campaign on April 8, 2026 that used an applescript:// URL to open Script Editor instead of asking victims to paste a command into Terminal. The browser still displayed a prompt, and the victim still had to run the presented script. The technique changes the route to execution, but it still depends on social engineering.
How this ClickFix variant works
Apple has added friction to the familiar trick of asking someone to paste shell commands into Terminal, including warnings, pauses and credential prompts. The campaign documented by Jamf Threat Labs used the applescript:// URL scheme to take a different route:
- A victim visits a compromised website or clicks a malicious link in an email.
- The page triggers an
applescript://URL handler. - The browser asks whether it may open Script Editor. If the user allows it, Script Editor presents a pre-filled script.
- If the user runs that script, shell commands retrieve and execute a later-stage payload identified by Jamf as Atomic Stealer.
The key change is not silent execution. It is the move away from Terminal's paste protections into a different trusted macOS application. The unexpected browser prompt and the pre-filled Script Editor window are both warning signs users can act on.
Why layered defenses matter
Built-in safeguards are useful, but each one protects a particular path. When attackers change that path, file, process and network evidence can provide another chance to spot trouble.
According to Jamf's 2026 Security 360 report, Trojans represented more than half of the Mac malware in its dataset of more than 150,000 devices. Signatures still help identify known files and infrastructure, but behavioral and network evidence can add context when a variant changes.
A script can call ordinary system tools, retrieve another payload and start a new process chain. Looking only for one known malicious file may miss that sequence, which is why the surrounding behavior matters too.
How PhantomSecure is being designed for attacks like this
PhantomSecure is still in development, so we cannot claim that a release blocks this campaign today. The design combines several signals instead of relying on a malware name alone.
Behavior and file signals
PhantomProtect is designed to combine Apple Endpoint Security events, local rules, file reputation, and behavior signals. For a script-delivered threat, useful evidence can include:
- An unexpected process chain from a browser or Script Editor into a shell
- Obfuscated commands that download and immediately execute another payload
- A newly created executable with suspicious provenance or matching local rules
- A connection to infrastructure covered by current local threat intelligence
Whether a specific build alerts, blocks, or misses a scenario must be established through release testing. No single signal guarantees detection.
Network filtering and visibility
Many infostealers also need a network connection to retrieve components or send stolen data. PhantomProtect is designed to enforce enabled network policy, while PhantomWatch is designed to help the user understand relevant activity.
The current architecture uses Apple's Network Extension filtering APIs rather than a product-created packet tunnel. Available connection and URL context can be compared with enabled local policy and threat intelligence. Visibility and enforcement depend on permissions, component health, and intelligence coverage.
If a destination is covered by current intelligence or an enabled rule, the filter is designed to block it. Unknown or newly changed infrastructure may not be covered, which is why network filtering is only one layer.
What you can do now
You don’t need to wait for another security tool to reduce your risk:
- Be suspicious of unexpected links in emails and messages. If someone sends you a link you weren't expecting, verify it's genuine before clicking. Hover over the link to see the real destination URL.
- Do not approve an unexpected prompt to open Script Editor. If a website opens a pre-filled script, close it without running it.
- Use a password manager with strong, unique passwords. This limits password reuse, although an infostealer may still collect credentials or active sessions for several accounts.
- Enable two-factor authentication (2FA) wherever possible. It helps when a password is stolen, although a stolen active session may require you to revoke sessions separately.
- Keep macOS and your applications up to date. Install security updates promptly, especially for browsers and other internet-facing apps.
These steps reduce risk but cannot remove it. Backups, updates, careful review of prompts, and layered security controls each address a different part of the attack chain.
What this campaign shows
This ClickFix campaign did not remove every warning or run without the user. It changed a familiar lure so the victim saw a browser prompt and a prepared script in Script Editor instead of Terminal paste instructions. Both steps were still opportunities to stop.
Jamf’s wider 2025 dataset, also covered by 9to5Mac, found that Trojans represented more than half of the Mac malware it observed. Microsoft’s Sapphire Sleet analysis describes a separate multi-stage macOS intrusion. These reports do not tell us that every Mac faces the same risk, but they do show why prompts, process behavior and network activity all deserve attention.
PhantomSecure is being built to add behavioral and network evidence around this kind of activity. We will publish scenario results and limitations after the relevant release candidate is tested.
Join the launch waitlist for development and future testing updates.
Sources & Further Reading
- Jamf Threat Labs: ClickFix macOS Script Editor Atomic Stealer
- Jamf: Security 360: 2026 Annual Trends Report
- 9to5Mac: Security Bite: Trojan Malware Dominates Mac, Now Half of All Detections, Says Jamf
- Microsoft Security Blog: Dissecting Sapphire Sleet's macOS Intrusion: From Lure to Compromise