Meow ClickFix macOS curl base64 decode payload execution via Terminal

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.