macOS ClickFix Curl Mach-O Drop Chained with Self-Delete or osascript Decoy

Duo Tech@duotech

•updated Jul 24, 2026•2•0•12

Detects the macOS ClickFix dropper chain where curl fetches a disguised Mach-O payload (winapp.bin/ZoomSDK.bin) within a process chain that also shows an osascript decoy dialog or a self-deleting shell script, consistent with BlueNoroff's fake meeting-app installer delivery.