Skip to content
ThreatCluster

Hackers Use AppleScript to Disguise macOS Malware as Legitimate Updates

First seen 2 Dec 2025, 18:33 UTC • •

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •March 12, 2026 at 13:27 UTC

Cybercriminals are leveraging AppleScript files to distribute malware disguised as legitimate updates for applications like Zoom and Microsoft Teams. This new attack vector allows them to bypass Apple's Gatekeeper security mechanisms, posing a risk to macOS users. The technique emerged following Apple's removal of a key security feature in August 2024.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 217d ago How this analysis works

More articles in this cluster (2)

Following this threat?

Track MacSync Stealer and Cloud Software Group in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed