Meow RAT Fileless AppleScript Execution via macOS Terminal (ClickFix)

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects the execution of osascript spawned directly from the Terminal application, a pattern identified in Meow RAT campaigns using ClickFix social engineering lures to execute malicious AppleScript in-memory.