Script Editor becomes Mac malware gateway

Atomic Stealer operators have opened a fresh lane into Apple computers by shifting a popular ClickFix scam away from Terminal and into Script Editor, a built-in macOS tool that many users would regard as less suspicious. The change matters because Apple moved in March to add stronger friction around Terminal-based copy-and-paste attacks in macOS Tahoe 26.4, and threat researchers now say attackers have adapted within weeks rather than abandoning the technique.

Researchers at Jamf Threat Labs said the campaign uses fake Apple-themed webpages that claim to help users reclaim storage space on a Mac. When a victim clicks an “Execute” button, the site calls the applescript:// URL scheme, prompting the browser to open Script Editor with malicious code already filled in. That removes the need for the victim to paste commands manually into Terminal, which had become a more obvious warning point after Apple’s latest safeguards.

The social engineering is straightforward and effective. Users are shown what appears to be a legitimate maintenance page, complete with step-by-step instructions that resemble a system clean-up guide. Instead of delivering a conventional malware download at the first stage, the attackers try to move the victim through a sequence of trusted native components: browser prompt, Script Editor launch and then execution of code that pulls in the final payload. For security teams, that progression is notable because it blends deception with legitimate macOS utilities rather than relying on a crude fake installer alone.

The payload in this case is Atomic Stealer, also known as AMOS, an information-stealing malware family that has circulated since 2023 and has remained a persistent threat to Mac users. Security vendors have long described it as a tool built to siphon passwords, browser data, keychain material, wallet information and other sensitive files. Microsoft said in February that it had observed macOS-focused infostealer campaigns since late 2025 using ClickFix-style prompts and other lures to deploy malware including Atomic macOS Stealer.

That wider context is important because the Jamf findings do not point to a one-off trick so much as an evolving pattern. Microsoft’s security team has warned that infostealers are extending beyond their traditional Windows focus and are increasingly targeting macOS through native utilities, AppleScript automation and deceptive web pages. In other words, the Script Editor method is not just a clever bypass of one Apple defence; it is part of a broader migration by criminal groups towards living-off-the-land tactics on Apple systems, where trusted tools help malware blend in.

Apple’s March 24 security release for macOS Tahoe 26.4 confirms the timeline for the platform changes now shaping this contest. The company documented a wide set of security fixes in that update, including an AppleScript-related issue in which an app might bypass Gatekeeper checks. Apple’s public security notes do not describe the Jamf-documented Script Editor campaign, and the company does not typically discuss unpatched or emerging abuse in detail before investigation. Even so, the combination of a Terminal-focused protection push and an AppleScript-related hardening entry underscores why defenders are watching native scripting tools more closely.

There is also a practical lesson in how fast adversaries test the edges of new safeguards. BleepingComputer reported on March 30 that Apple had added a warning aimed at blocking harmful pasted commands in Terminal. Jamf then published its Script Editor findings on April 8. That sequence suggests attackers are monitoring security changes closely and adjusting their delivery chains quickly when a familiar route becomes noisier or less reliable.

For users, the episode is another reminder that built-in apps are not proof of safety when a workflow begins on a deceptive webpage. A browser request to open Script Editor, Terminal or any other system utility should be treated with caution unless the action was clearly expected and initiated from a trusted source. For companies, the threat goes beyond an individual Mac. Microsoft has warned that stolen credentials from these campaigns can lead to account takeover, cloud intrusion, theft of developer secrets and broader follow-on compromise.