ClickFix-style base64 curl-to-zsh pipeline pasted into macOS Terminal

Ethan Andrews@eandrews

•updated Aug 3, 2026•0•0•15

This rule detects a common ClickFix-style social engineering attack pattern used to deploy macOS stealers (like AMOS). It identifies terminal commands where a user is tricked into pasting a base64-encoded string into their shell, which is then decoded using 'openssl base64 -d -A', retrieved via 'curl', and piped directly into 'zsh' for immediate, obfuscated execution.