macOS Suspicious Curl Download to /var/tmp

Elgonad .@elgonad

•updated Apr 7, 2026•6•0•183

Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.