ClickFix macOS: base64 curl decoded via openssl piped to zsh

Arnold Chan@slaz

•updated Sep 17, 2026•0•0•4

This rule detects command-line activity where a remote resource is downloaded via 'curl', decoded using 'base64', and then piped directly into a shell interpreter (sh, bash, or zsh). This pattern is commonly used in fileless execution or stage-one payload delivery by attackers to execute malicious scripts directly from memory.