Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings

A macOS malware campaign delivering the Atomic Stealer (AMOS) has shifted its execution vector from Terminal to Script Editor to evade macOS 26.4's paste-warnings for ClickFix attacks; attackers present fake Apple guidance in the browser to trick users into pasting malicious commands. Jamf Threat Labs identified the campaign, which functions as an infostealer/backdoor, and recommends mitigations such as restricting clipboard/run-dialog use and blocking malicious sites.