Atomic Stealer macOS Campaign Bypasses Apple's Terminal Warnings by Switching to Script Editor

A new macOS malware campaign delivering the Atomic Stealer (AMOS) infostealer and backdoor has been discovered by Jamf Threat Labs. The campaign employs a ClickFix social-engineering attack that bypasses Apple's recently introduced security warnings in macOS 26.4, which were designed to alert users when pasting commands into Terminal. Instead of relying on Terminal, the attackers have shifted the execution vector to Script Editor, a built-in macOS application for running AppleScript and JavaScript code.

The ClickFix technique presents victims with a fake browser window purportedly from Apple, offering instructions to reclaim disk space. Users are guided through steps that ultimately lead them to open Script Editor and paste what appears to be legitimate commands but are in fact malicious payloads. This subtle change allows the malware to execute without triggering the Terminal warning that Apple added to counter ClickFix attacks, as Script Editor does not trigger the same security feature.

Atomic Stealer (AMOS) is a known infostealer targeting macOS systems, capable of harvesting credentials, cryptocurrency wallets, and other sensitive data. The campaign's use of Script Editor represents an adaptation to Apple's security improvements, demonstrating how attackers quickly evolve their methods when one avenue is blocked. Thijs Xhaflaire, senior threat and detections researcher at Jamf Threat Labs, noted, "It's a meaningful friction point, but as this campaign illustrates, when one door closes, attackers find another."

The exact distribution method for luring victims to the fake Apple page remains unclear, but similar ClickFix campaigns have historically relied on malicious links or malvertising. Once the user executes the script, the malware payload is delivered, compromising the system. The shift from Terminal to Script Editor preserves the familiar ClickFix workflow while evironment while changing the underlying execution mechanism, making it harder for users to recognize the threat.

Apple's macOS 26.4 update introduced a security feature that scans commands pasted into Terminal and warns users if they appear malicious. By moving to Script Editor, the attackers avoid this detection entirely. This highlights a broader trend where threat actors continuously adapt to OS-level security changes, finding alternative execution paths to achieve their goals.

Network administrators can mitigate such attacks by restricting the use of run dialog and clipboard, limiting execution of potentially malicious executables, and blocking access to suspicious advertisements and websites. User education remains critical, as ClickFix attacks rely on social engineering to trick individuals into executing commands. The Atomic Stealer campaign serves as a reminder that even as platforms improve security, attackers will seek out new vectors to bypass protections.