AppleScript Abused to Spread Fake Zoom and Teams macOS Updates

Hackers use AppleScript to disguise macOS malware as fake app updates, bypassing Apple’s protections.

Security researchers have uncovered a new attack vector leveraging AppleScript (.scpt) files to deliver malware disguised as legitimate software updates, including fake Zoom, Microsoft Teams, and Chrome installers.

This method highlights a growing threat to macOS users as cybercriminals weaponize native scripting tools to evade Apple’s Gatekeeper security mechanisms.

In 2024 , Apple removed a widely abused infection vector: the right-click and open Gatekeeper override .

Since then, attackers have shifted toward using compiled AppleScript ( .scpt ) files as delivery vehicles for malware.

These files open directly in Script Editor.app, a legitimate macOS application that provides a user-friendly interface for executing scripts.

When victims double-click these malicious files, they are presented with an interface that looks benign — often framed as part of an “update” or “installation” process.

Social engineering prompts encourage users to click “Run” or press Command + R, unintentionally executing the embedded malicious code.

Researchers discovered that even when such files are quarantined by Gatekeeper, users can still manually execute them, effectively bypassing built-in protections.

These AppleScript-based attacks rely on a layered blend of social engineering, platform behavior, and deliberate obfuscation to trick users into executing code that appears benign.

Attackers craft files with familiar update- or installer-style names (for example, variants that reference Teams, Zoom, or Chrome) and often embed convincing branding and custom file icons so the item looks like an ordinary updater or document when viewed in Finder.

Because macOS opens .scpt files in Script Editor by default, a double-click exposes a graphical interface with Run controls, which is what a user would expect to see.

To hide the malicious payload from cursory inspection, threat actors bury the active commands far down in the script text, separated by long runs of blank lines or nonfunctional .

In compiled AppleScript samples the payload can be even harder to inspect because the file is not plain text, so casual viewers and many automated scanners won’t easily surface the embedded behavior.

When the user presses “Run” (or the keyboard shortcut), the visible update prompt is displayed while the script quietly performs background actions — for example, opening remote URLs, launching downloaders, or invoking system commands — without additional visible alerts.

The background activity is designed to feel legitimate: a plausible update dialog distracts the user while network requests retrieve follow-on payloads from attacker-controlled hosting.

Those remote resources then deliver the actual malware payloads (stealers, RATs, or installers) which the script stages and executes.

Because these actions are performed by a standard macOS app (Script Editor) and often by user-initiated interaction, they can circumvent Gatekeeper quarantine protections and evade simple signature-based detection.

Many of the .scpt samples register zero detections on scanning services, giving attackers a valuable window of operational freedom.

Delivery is straightforward and effective — phishing emails, malicious web pages posing as update notices, or compromised download sites distribute the .scpt files inside ZIPs or DMGs that preserve custom icons and resource forks, increasing the illusion of legitimacy.

Once executed, the chain can lead to persistence mechanisms, credential theft, and lateral movement — all while appearing to be nothing more than a routine update prompt to the victim.

Beyond clever scripting, attackers use custom icons and naming conventions to disguise AppleScript files as common document formats.

Samples have been identified with names like Stable1 Investment Proposal (Draft).pptx.scpt and AM Management Strategic Collaboration.docx.scpt .

On macOS, these files display convincing Word or PowerPoint icons, making them nearly indistinguishable from legitimate documents.

Additionally, when bundled within .zip or .dmg (disk image) files, macOS preserves the embedded resource fork containing the fake icon, ensuring the deception persists once extracted or mounted.

This tactic aligns with prior “drag-and-drop to Terminal” malware delivery techniques but with a lower barrier to execution — simply double-clicking the file is enough to trigger infection.

As AppleScript is exploited to deliver disguised macOS malware, organizations must adopt a layered defense strategy that combines technical controls with user awareness.

The rise of AppleScript-based malware delivery reflects a broader shift in macOS attack strategies — from exploiting vulnerabilities to abusing legitimate system features.

As attackers increasingly blend social engineering with trusted automation tools, traditional defenses alone are no longer sufficient.

This growing abuse of legitimate macOS features underscores why adopting a zero-trust approach — where every action, user, and process must be verified — has become essential.

Ken Underhill is an award-winning cybersecurity professional, bestselling author, and seasoned IT professional. He holds a graduate degree in cybersecurity and information assurance from Western Governors University and brings years of hands-on experience to the field.

Hackers are exploiting Meta Business Suite to launch global phishing attacks.

North Korean hackers are exploiting Google’s Find Hub to wipe Android devices.

Ivanti patched severe Endpoint Manager flaws that could let attackers gain system access.

Holiday fraud in 2025 is evolving faster than ever, as attackers use AI, automation, and stolen data to launch large-scale campaigns.