This threat involves a macOS malware variant that abuses the applescript:// URL scheme to invoke the Script Editor application directly, bypassing the Terminal, to deliver the Atomic Stealer infostealer payload. The attack leverages AppleScript capabilities on macOS to execute malicious code stealthily. The malware is linked to the ClickFix style of attack and uses URLs hosted on dryvecar.com for payload delivery. The campaign was discovered by Jamf Threat Labs and reported by AlienVault OTX. No CVE or vendor advisory is available, and no patch or fix has been documented.

The malware delivers an infostealer payload capable of harvesting sensitive information from infected macOS systems. By bypassing the Terminal and using Script Editor via the applescript:// URL scheme, it may evade some traditional detection mechanisms. However, there is no evidence of widespread exploitation or active campaigns in the wild at this time.

No official patch or remediation guidance is currently available. Security teams should monitor for the provided indicators of compromise, including the specified hashes and URLs associated with dryvecar.com. Restricting or monitoring the use of applescript:// URL scheme and the Script Editor application may help reduce risk. Users should exercise caution when interacting with unknown links or scripts that invoke AppleScript. Patch status is not yet confirmed — check vendor advisories for updates.