Hackers Weaponize AppleScript to Creatively Deliver macOS Malware Mimic as Zoom ...

Threat actors continue to evolve their techniques for bypassing macOS security controls, shifting away from traditional attack vectors that Apple has systematically patched.

Following Apple’s removal of the “right-click and open” Gatekeeper override in August 2024, attackers have identified and weaponized a new delivery mechanism using compiled AppleScript files with deceptive naming conventions.

These .scpt files are increasingly being leveraged to distribute malware that masquerades as legitimate software updates, including fake Zoom and Microsoft Teams installers.

The emerging threat centers on .scpt files that open directly in Script Editor.app by default, creating an attractive attack surface for threat actors.

When users double-click these files, the application displays a user-friendly interface with social engineering prompts encouraging execution.

The malware operators strategically embed malicious code after extensive blank lines to hide the actual payload from casual inspection.

Security analysts at Moonlock Labs and Pepe Berba identified this technique gaining prominence in recent months, discovering sophisticated campaigns that previously appeared in advanced persistent threat operations.

Pepe Berba noted that while AppleScript files themselves are not new, the proliferation of samples using this technique represents a concerning trend, particularly as commodity malware families like MacSync Stealer and Odyssey Stealer have adopted the methodology.

This represents a classic case of advanced techniques trickling down from state- actors to common cybercriminal operations.

The technical structure of these scripts employs several clever deception tactics.

A sample analyzed reveals AppleScript code such as set teamsSDKURL to " followed by do shell script "open -g " & quoted form of teamsSDKURL .

This command structure opens malicious URLs in the background while presenting legitimate-looking update prompts to the user.

The filenames themselves serve as the primary deception layer, with variants including “MSTeamsUpdate.scpt,” “Zoom SDK Update.scpt,” and “Microsoft.TeamsSDK.scpt.”

The persistence and detection evasion capabilities of these attacks deserve particular attention.

Many .scpt files currently maintain zero detections on VirusTotal, providing attackers with significant operational runway before security vendors implement detection signatures.

The files often arrive through phishing emails or compromised websites offering software updates, targeting users seeking legitimate version upgrades.

This attack vector presents a significant challenge for macOS security, as it exploits user trust in familiar application names while leveraging native system tools that legitimate users regularly interact with.

Organizations must educate users verifying software updates through official channels and implement endpoint detection solutions capable of monitoring AppleScript execution patterns.

Tushar is a senior cybersecurity and breach reporter. He specializes in covering cybersecurity news, trends, and emerging threats, data breaches, and malware attacks. With years of experience, he brings clarity and depth to complex security topics.

A new phishing campaign is targeting iPhone owners who have lost their devices, exploiting their…

A Chinese national has been sentenced to over 11 years in prison following one of…

A vulnerability has been discovered in Lite XL, a lightweight text editor, that could allow…

Recognition we believe underscores global customer trust and proven product excellence for security teams evaluating…

A large phishing campaign has been targeting travelers worldwide, using more than 4,300 fake domains…

Cloud Software Group has disclosed a cross-site scripting (XSS) vulnerability affecting NetScaler ADC and NetScaler…