Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

**Executive summary:** This report details an ongoing Clickfix phishing campaign targeting macOS users that lures victims into pasting terminal commands (e.g., echo '...'+ | base64 -d | bash) which run AppleScript payloads to collect browser profiles, crypto wallets, documents, Keychain items, and other sensitive files, then package and exfiltrate them to attacker-controlled servers; the analysis includes payload behavior, infrastructure fingerprints (unusual ports, permissive CORS), hunting SQL queries, and enumerated IOCs for detection and mitigation.