All Detections

Mac Clickfix Bash Loader Fetching

avatar
Ibrahim Saud@tektrix
updated Jun 21, 20262011

Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.

YARA-L