Loading story…
Security researchers have identified a new threat vector targeting macOS systems, where stealer malware is being distributed using AppleScript (.scpt) files. This technique allows attackers to bypass traditional detection mechanisms by leveraging the scripting capabilities native to macOS, increasing the stealth and effectiveness of malware campaigns against Apple users. The emergence of this vector highlights the evolving tactics of threat actors seeking to compromise macOS environments, which have historically been perceived as more secure than other platforms.
In response to the growing sophistication and prevalence of macOS-targeted malware, security experts are developing new tools and datasets to improve detection and defense. Notably, researchers are preparing to release Malet, the largest public dataset of macOS malware, and Katalina, an open-source static analysis tool designed to process large volumes of binaries efficiently. These initiatives aim to address the gap in macOS malware research and provide defenders with better resources to identify and mitigate threats, including those exploiting AppleScript-based attack vectors.
Pull IOCs and campaign context straight into your stack.
2 events from the most recent confirmed update back to the earliest known activity.
A separate report highlighted the release or promotion of new defensive security tools designed to detect and respond to increasing macOS malware and threat activity. The tools were positioned as a response to the expanding macOS threat landscape.
Security reporting described the emergence of compiled AppleScript (.scpt) files as a new delivery and evasion technique for macOS stealer malware. The coverage framed this as part of a broader rise in macOS-focused threats.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are increasingly targeting macOS users with **infostealers** and distribution-as-a-service models, reflecting a broader “gold rush” in Apple-focused malware development. Reporting highlights macOS stealers targeting browser credentials and cryptocurrency assets (including seed phrases) and notes tactics to evade Apple controls such as obtaining valid Apple developer signatures to bypass *Gatekeeper*; one cited example is *MacSync* being notarized and signed under Team ID `GNJLS3UYZ4`. The same reporting describes ecosystem-scale enablement, including large-scale compromise of WordPress sites for distribution and novel command-and-control approaches such as using blockchain smart contracts (e.g., on **BNB Smart Chain**), alongside paid-traffic abuse (e.g., promoting malicious AI chat content via ads) to push stealer payloads. Separately, a Darktrace-described investigation details a **multi-stage macOS malware** campaign that prioritizes *social engineering* over exploitation to defeat Apple’s **Transparency, Consent, and Control (TCC)** privacy framework. Victims are lured via phishing to open an AppleScript masquerading as a document (`Confirmation_Token_Vesting.docx.scpt`), which displays a fake “Compatibility” error and instructs the user to launch a “Compatibility Wizard” (e.g., using a keyboard shortcut) that effectively tricks them into authorizing execution and granting access. Together, the reporting indicates macOS threats are increasingly succeeding by combining credential/crypto theft objectives with user-prompt manipulation and trust-abuse techniques rather than relying on kernel or sandbox escapes.
Jun 29, 2026
Threat researchers reported a renewed surge of **Odyssey Stealer** activity targeting **macOS**, with infections spreading rapidly across multiple regions. The malware is typically delivered via social engineering—masquerading as legitimate software updates, fake apps, or cracked tools—and is designed to steal high-value data including **cryptocurrency wallets**, browser-stored credentials (e.g., *Chrome* and *Safari*), personal documents, and items stored in the macOS **Keychain**. Moonlock Lab telemetry described a sharp increase in detections and a fast-expanding geographic footprint, consistent with a coordinated campaign and improved stealth/evasion techniques. In parallel, analysis of Apple’s built-in malware defenses noted an unusual **XProtect** update (version **5327**) that significantly expanded a newer YARA ruleset file, `XPScripts.yr`, focused on detecting malicious **OSAScript** (including AppleScript) content at execution time via the Open Scripting framework. The update increased OSAScript-focused rules from 2 to 14, reflecting growing abuse of lightweight, script-driven infection chains in recent macOS stealer campaigns (including AMOS/SOMA), where victims are coached into running obfuscated Terminal commands and downloading payloads (e.g., via `curl`) to avoid quarantine controls. Together, the reporting indicates escalating macOS infostealer pressure and corresponding defensive tuning by Apple to better detect script-based tradecraft used to bootstrap these infections.
Jun 29, 2026
Researchers identified a **ClickFix-style** campaign targeting macOS users that swaps Terminal-based execution for **Script Editor** to bypass newer Apple protections. Victims are lured to fake Apple-themed pages such as “Reclaim disk space on your Mac,” which invoke the `applescript://` URL scheme and open Script Editor with a pre-filled AppleScript. If the user runs it, the script conceals a malicious shell command that decodes a URL, uses `curl` with TLS certificate validation disabled, and pipes the response directly into `zsh` for in-memory execution. The activity, discovered by **Jamf Threat Labs**, ultimately downloads and launches a Mach-O variant of **Atomic Stealer**, an infostealer built to harvest browser credentials, saved passwords, cryptocurrency wallets, and other sensitive data from macOS systems. Researchers said the campaign appears to be an adaptation to Apple’s paste-command scanning protections added in macOS 26.4 for Terminal abuse; while newer macOS versions also warn about unidentified scripts, the attack can still succeed if users follow the prompts. Reported infrastructure tied to the campaign includes `dryvecar.com`, `storage-fixes.squarespace.com`, and `cleanupmac.mssg.me`.
Jun 29, 2026