u/moonlock_security

No product pitch here — posting because we keep seeing this in the wild and the fleet-side mitigations aren't obvious.

Short version of where things stand:

• Apple added a mitigation in macOS that blocks commands pasted into Terminal from being executed straight away. It kills the most common ClickFix flow (fake CAPTCHA → "press ⌘V then Enter").
• It does not cover variants that avoid Terminal entirely. We've seen the applescript:// route used specifically to sidestep it.
• The payload in most of the cases we've looked at is an AMOS-family stealer. Keychain, browser cookies, crypto wallets. On a managed fleet the interesting part isn't the theft, it's that some builds now ship a backdoor component, so it's persistence, not smash-and-grab.

What we'd suggest checking on your side:

• Alert on osascript spawned from a browser process
• Watch ~/Library/LaunchAgents and /Library/LaunchDaemons for new plists written outside your deployment window
• Curl/wget to raw IPs from user context is still one of the higher-signal, low-noise detections here
• User comms: the "paste this to fix your browser" pattern is worth putting in your next security note. It reads as legitimate troubleshooting to non-technical staff

Happy to share hashes/IOCs from the samples we've analysed if that's useful to anyone. What are you seeing on your fleets?