ClickFix Malware Uses macOS Script Editor to Deliver Atomic Stealer

Jamf Threat Labs discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal entirely.

• The Psychedelic Stealer: When the CAPTCHA Is the InstallerMalware2026-09-25
• New PamStealer variant targets macOS via fake crypto walletMalware2026-09-22
• How Attackers Redirect Crypto PaymentsMalware2026-10-29
• ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure VulnerabilityLowVulnerability2026-10-28
• September 2026 Infostealer Trend ReportMalware2026-10-28