ClickFix finds a new way to infect Macs

ClickFix campaigns are leveraging the applescript:// deep link to open Script Editor with pre-filled scripts that run obfuscated curl | zsh chains, pulling and executing Atomic Stealer (AMOS) or similar macOS infostealers; this replaces the older Terminal copy-paste lure and increases the likelihood of users granting permissions and infecting their own systems. The report describes how the technique works, notes ClickFix's large share of loader activity, and provides user-focused mitigation advice.