ClickFix Malware Evolves to Bypass macOS Security Controls
Cybercriminals have adapted the ClickFix malware campaign to target macOS users by exploiting Script Editor instead of Terminal, effectively bypassing security measures that monitor command-line activity. The attack disguises the AMOS malware as a legitimate Claude AI installer, leveraging social engineering to trick users into executing malicious scripts directly from their browser. This evolution demonstrates how attackers continuously adapt their techniques to circumvent detection mechanisms, making user education and proper system configuration critical for defense. Organizations must recognize that even trusted applications like Script Editor can become attack vectors when users are manipulated into running malicious code.
Tactical Insight
Immediate actions
- Configure Gatekeeper to only allow applications from the Mac App Store or identified developers
- Enable XProtect and automatic security updates on all macOS systems
- Educate users about verifying software downloads from official sources only
Long-term improvements
- Implement application allowlisting to prevent unauthorized script execution
- Deploy endpoint detection and response (EDR) solutions that monitor Script Editor activity
- Establish regular security awareness training focused on social engineering tactics
Detection measures
- Monitor Script Editor launches and executions through system logs
- Set up alerts for unusual browser-to-application handoffs
- Implement network monitoring to detect AMOS malware command-and-control communications