New macOS stealer campaign uses Script Editor in ClickFix attack

A campaign observed by security researchers uses malicious Apple-themed web pages and the applescript:// URL scheme to launch macOS Script Editor with prefilled code that runs an obfuscated 'curl | zsh' command, downloading and executing a Mach-O payload identified as Atomic Stealer (AMOS). The infostealer targets Keychain, browser cryptocurrency wallets, passwords, cookies and can include a backdoor for persistence; users are advised not to run Script Editor prompts from untrusted sources and to rely on official Apple guidance.