New Clickfix Variant ‘Matryoshka’ Attacking Users to Deploy macOS Stealer Malware

A sophisticated macOS social-engineering campaign called "Matryoshka" uses typosquatted domains and a ClickFix-style Terminal paste command to execute a nested, encoded payload that runs in memory. The multi-stage loader decodes and decompresses an AppleScript payload to harvest browser credentials and target crypto wallet apps (Trezor Suite, Ledger Live), employing evasion techniques such as heredoc-embedded payloads, detached background execution, suppressed I/O, and C2 checks that hinder automated scanners.