T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution

Shell spawned by Terminal.app (or another macOS terminal emulator) running a pipe-to-shell or base64-decode-to-shell one-liner, which is the macOS branch of a ClickFix lure. The counterfeit reCAPTCHA instructs the victim to open Terminal from Applications -> Utilities, press Command+V against a clipboard the page has already poisoned, and press Enter. Observed 2026-08-11 as the macOS half of an EtherHiding campaign that branched on navigator.userAgent and served a separate on-chain payload to Macintosh visitors. The macOS variant of that campaign also randomized its injected CSS class names where the Windows variant used static ones, which suggests it is the more actively maintained build and argues for treating macOS coverage as equal priority rather than as a follow-up. Detection anchors on the terminal-emulator parent plus remote-fetch-into-interpreter argument shape; a bare curl or bash under Terminal is normal developer behavior and is deliberately not matched on its own.

Intel context

The technique this rule covers is quiet in the corpus this week — no current KEV, OSINT, or active-family signal. The detection stands ready; there is simply nothing exercising it right now. (Checked September 18, 2026.)

Rule ID: 67bdcacb-65fe-5de6-a9a5-60d30ddeda59
Status: experimental
Level: high
Log source: category: process_creation · product: macos
Date: 2026-08-11
Modified: 2026-08-11
ATT&CK: T1204.004 (signal rollup)
Canonical YAML: t1204-004-clickfix-macos-terminal-execution.yml

References

False positives

Developers installing tooling via documented curl-pipe-shell instructions (Homebrew, rustup, nvm and similar). This is the dominant false positive on engineering endpoints — baseline the common installer URLs and allowlist them by command text rather than dropping the remote-exec selection.
Provisioning and dotfile bootstrap scripts run interactively on first login.
Security tooling and CI runners that shell out under a terminal emulator.

Rule YAML

title: 'T1204.004 Malicious Copy and Paste — ClickFix macOS Terminal Execution'
id: '67bdcacb-65fe-5de6-a9a5-60d30ddeda59'
status: 'experimental'
description: 'Shell spawned by Terminal.app (or another macOS terminal emulator) running a pipe-to-shell or base64-decode-to-shell one-liner, which is the macOS branch of a ClickFix lure. The counterfeit reCAPTCHA instructs the victim to open Terminal from Applications -> Utilities, press Command+V against a clipboard the page has already poisoned, and press Enter. Observed 2026-08-11 as the macOS half of an EtherHiding campaign that branched on navigator.userAgent and served a separate on-chain payload to Macintosh visitors. The macOS variant of that campaign also randomized its injected CSS class names where the Windows variant used static ones, which suggests it is the more actively maintained build and argues for treating macOS coverage as equal priority rather than as a follow-up. Detection anchors on the terminal-emulator parent plus remote-fetch-into-interpreter argument shape; a bare curl or bash under Terminal is normal developer behavior and is deliberately not matched on its own.'
references:
    - 'https://thrunt.me/sigma/t1204-004-clickfix-macos-terminal-execution.yml'
    - 'https://attack.mitre.org/techniques/T1204/004/'
author: 'Applied Cybernetics Group (via thrunt.me)'
date: '2026-08-11'
modified: '2026-08-11'
tags:
    - 'attack.execution'
    - 'attack.t1204.004'
    - 'tlp.clear'
logsource:
    category: 'process_creation'
    product: 'macos'
detection:
    selection_terminal_parent:
        ParentImage|endswith:
            - '/Terminal'
            - '/iTerm2'
            - '/kitty'
            - '/alacritty'
            - '/WezTerm'
    selection_interpreter:
        Image|endswith:
            - '/bash'
            - '/sh'
            - '/zsh'
            - '/osascript'
            - '/python3'
    selection_remote_exec:
        CommandLine|contains:
            - 'curl -'
            - 'wget '
            - 'base64 -d'
            - 'base64 --decode'
            - 'eval "$('
            - '| sh'
            - '| bash'
            - '| zsh'
            - 'osascript -e'
    condition: 'selection_terminal_parent and selection_interpreter and selection_remote_exec'
falsepositives:
    - 'Developers installing tooling via documented curl-pipe-shell instructions (Homebrew, rustup, nvm and similar). This is the dominant false positive on engineering endpoints — baseline the common installer URLs and allowlist them by command text rather than dropping the remote-exec selection.'
    - 'Provisioning and dotfile bootstrap scripts run interactively on first login.'
    - 'Security tooling and CI runners that shell out under a terminal emulator.'
level: 'high'

The YAML file above is the canonical artifact — machine consumers should subscribe via /sigma/manifest.json and fetch t1204-004-clickfix-macos-terminal-execution.yml directly. Each rule's live intel context is in /sigma/evidence.json keyed by slug. This page is a rendered view, regenerated daily.