macOS ClickFix Base64 Zsh Payload Execution

Elgonad .@elgonad

•updated Apr 7, 2026•2•0•134

Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.