MalwareApr 10, 2026
⚠️ BAD - New macOS ClickFix variant skips Terminal entirely — uses Script Editor, launched straig...
New ClickFix macOS variant bypasses Terminal using Script Editor to deliver AMOS malware.
Vendor Watch
Run SentinelOne?
Get an email when a reviewed story names SentinelOne, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A new variant of the ClickFix malware campaign has emerged targeting macOS users, circumventing traditional Terminal-based execution by leveraging Script Editor instead. The attack delivers AMOS malware disguised as a fake Claude AI installer, launched directly from the browser. SentinelOne reports protection against this variant.
Indicators of Compromise
- malware — ClickFix
- malware — AMOS
Entities
macOS (product)SentinelOne (vendor)Claude (product)