---
id: 6227
title: "Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure"
source_domain: hunt.io
source_url: "https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing"
published_at: "2025-07-22T00:00:00Z"
tags: ["phishing", "macos", "c2", "infostealer", "clickfix", "applescript"]
phying_url: "https://phying.com/item/6227"
lang: en
---

# Clickfix on macOS: AppleScript Stealer, Terminal Phishing, and C2 Infrastructure

## Summary

A macOS ClickFix campaign uses fake security prompts to push victims into running AppleScript via Terminal, stealing browser data, crypto wallets, and documents without any download.

## Intelligence Metadata

- **Sources:** hunt.io
- **Published:** 2025-07-22T00:00:00Z
- **Original:** https://hunt.io/blog/macos-clickfix-applescript-terminal-phishing
- **Phying News:** https://phying.com/item/6227