All Detections

Mac Clickfix Bash Loader Fetching

avatar
nomit vyas@xoxo
updated Jun 25, 2026005

Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.

YARA-L