Hackers Use AppleScript to Disguise macOS Malware as Legitimate Updates

First seen 2 Dec 2025, 18:33 UTC • Cybersecuritynews

•7

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Cybercriminals are leveraging AppleScript files to distribute malware disguised as legitimate updates for applications like Zoom and Microsoft Teams. This new attack vector allows them to bypass Apple's Gatekeeper security mechanisms, posing a risk to macOS users. The technique emerged following Apple's removal of a key security feature in August 2024.

How this analysis works

Attack Flow

11 entities, 12 inferred relationships (STIX 2.1).

Technique (3)

Malware
Phishing
Cross-site Scripting

Organization (1)

Cloud Software Group

Indicator (1)

editor.app

Malware (2)

MacSync Stealer
Odyssey Stealer

Affected Platform (1)

MacOS

Tool (2)

AppleScript
Script Editor.app

Vulnerability (1)

Relationships

MacSync Stealer exploits XSS
Odyssey Stealer exploits XSS
AppleScript exploits XSS
Script Editor.app exploits XSS
MacSync Stealer communicates with editor.app
Odyssey Stealer communicates with editor.app
XSS targets MacOS
MacSync Stealer targets Cloud Software Group
Odyssey Stealer targets Cloud Software Group
Malware targets MacOS
Phishing targets MacOS
Cross-site Scripting targets MacOS

Continue Reading

Slovakia Discovers Russian Backdoor in Traffic Speed Cameras Malicious Ads Target Homebrew Users with MacSync Stealer Malware MacSync Infostealer Exploits Google Search for Claude Installation Trojan Malware Surge and Outdated Software Threaten Mac Security MacSync Stealer Targets macOS via Malicious Google Ads Campaign Microsoft Identifies Over 30 Domains Linked to MacSync Stealer Malware

Hackers Use AppleScript to Disguise macOS Malware as Legitimate Updates

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading