macOS ClickFix: Base64 payload piped into zsh via Terminal

Emiliano Mema@Nosalva

•updated Aug 26, 2026•6•0•12

Detects the execution of base64 decoded commands piped directly into a Unix shell (sh, bash, or zsh). This is a common technique used by attackers to execute obfuscated payloads, often found in reverse shells or stage-two malware delivery, where the attacker encodes their command to bypass simple keyword-based security filters.