ClickFix macOS Attack Uses Script Editor to Bypass Security Controls

A newly observed ClickFix-style macOS campaign lures users to an Apple-themed webpage that triggers an applescript:// URL to open a pre-filled script in macOS Script Editor; the script decodes an obfuscated URL, uses curl (with -k) to fetch and pipe a payload to zsh, and delivers a Mach-O binary identified as an Atomic Stealer variant. Researchers report associated IoCs including domain dryvecar.com, malicious pages storage-fixes.squarespace.com and cleanupmac.mssg.me, the filename "helper", and SHA256 3d3c91ee762668c85b74859e4d09a2adfd34841694493b82659fda77fe0c2c44.