Phexia ClickFix curl|bash script launching osascript -e dropper on macOS

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects potential macOS dropper activity where a shell downloads a script using curl (piped or fetched) and subsequently spawns osascript to execute AppleScript commands.