macOS ClickFix AppleScript Stealer Hijacks Crypto Wallets

### Executive Summary Netskope Threat Labs identified 'Meow', an AppleScript-based macOS infostealer/RAT active since May 2026 that uses fake troubleshooting sites and clipboard-manipulation to achieve in-memory, fileless execution; it harvests browser credentials, session cookies, messaging tokens, and cryptocurrency wallet data (including replacing wallet apps), maintains C2-based persistence, and targets macOS users across multiple regions. Recommended defenses include blocking malicious lure domains, monitoring terminal/clipboard activity, checking for unusual launch daemons (e.g., com.apple.accountsd), and reinstalling wallet software from official sources.