Meow RAT Crypto Wallet Extension Data Theft via osascript

Tim Peck@timpeck

•updated Jun 22, 2026•0•0•24

Detects Meow RAT (ClickFix campaign) copying Chromium browser extension data directories associated with cryptocurrency wallets, including MetaMask (nkbihfbeogaeaoehlefnkodbefgpgknn), via osascript on macOS.