Loading story…
Splunk Enterprise Security released an anomaly analytic to identify suspicious macOS osascript executions that invoke AppleScript display alert or display dialog commands using credential- or security-themed wording. Such dialogs can impersonate macOS authentication or security notices and trick users into disclosing passwords and other sensitive data, a technique tracked as MITRE ATT&CK T1056.002 (GUI Input Capture).
The detection uses osquery process telemetry, maps the execution mechanism to T1059.002 (AppleScript), and generates intermediate risk events rather than notable findings; it is disabled by default. osascript is a legitimate native macOS utility but can also execute AppleScript or JavaScript for Automation to collect clipboard or system data, manipulate applications, and present fake authentication prompts, so alerts require investigation to distinguish malicious activity from legitimate MDM, deployment, support, and automation scripts.
See real exploitation activity before you spend the cycle.
1 event from the most recent confirmed update back to the earliest known activity.
Splunk updated its "MacOS Osascript Displaying Suspicious User Prompt" analytic, which detects osascript commands using AppleScript dialogs or alerts containing credential- and security-themed language. The disabled-by-default analytic creates intermediate risk events from osquery process telemetry and is mapped to ATT&CK AppleScript and GUI Input Capture.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See real exploitation activity behind this advisory so you can triage it against everything else in the queue.
4 references tracked. Mallory keeps watching after this page renders.
research.splunk.com
Open sourceloobins.io
Open sourceattack.mitre.org
Open sourceattack.mitre.org
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Elastic Security Labs reported a suspicious multi-day activity chain on a macOS developer endpoint in which **Claude Code** appeared as the trusted parent process for shells and helper tools that made credentialed HTTP requests, created reverse tunnels, and installed **LaunchAgent** persistence. Telemetry showed `zsh` processes authenticating to ephemeral `localhost[.]run`, `lhr[.]life`, and `trycloudflare[.]com` URLs, collecting application metrics, starting a Cloudflare Quick Tunnel, and writing LaunchAgents to maintain access. Elastic said the behavior could reflect either remote administration of a locally exposed dashboard or a more serious compromise, but noted that detections fired for suspicious web-service connections, suspicious top-level domains, persistence via a GenAI tool, and process discovery. The broader host history also included earlier tunnel and VPN binaries, a suspicious Python script launched from `zsh`, and related coding-agent-parented variants involving **macOS Keychain** access, LOLBin staging, and retrieval of unsigned binaries. The activity aligns with known attacker tradecraft for harvesting credentials from Apple’s Keychain, where passwords, keys, certificates, and other secrets can be accessed through Keychain utilities or direct file access if the user’s Keychain password is available. Elastic advised defenders to treat coding-agent-linked credentialized HTTP activity, reverse tunnels, LaunchAgent persistence, and possible Keychain access as **high-severity** signals even when the tooling involved is legitimate and the use case may be dual-purpose.
Aug 10, 2026
Threat researchers reported a renewed surge of **Odyssey Stealer** activity targeting **macOS**, with infections spreading rapidly across multiple regions. The malware is typically delivered via social engineering—masquerading as legitimate software updates, fake apps, or cracked tools—and is designed to steal high-value data including **cryptocurrency wallets**, browser-stored credentials (e.g., *Chrome* and *Safari*), personal documents, and items stored in the macOS **Keychain**. Moonlock Lab telemetry described a sharp increase in detections and a fast-expanding geographic footprint, consistent with a coordinated campaign and improved stealth/evasion techniques. In parallel, analysis of Apple’s built-in malware defenses noted an unusual **XProtect** update (version **5327**) that significantly expanded a newer YARA ruleset file, `XPScripts.yr`, focused on detecting malicious **OSAScript** (including AppleScript) content at execution time via the Open Scripting framework. The update increased OSAScript-focused rules from 2 to 14, reflecting growing abuse of lightweight, script-driven infection chains in recent macOS stealer campaigns (including AMOS/SOMA), where victims are coached into running obfuscated Terminal commands and downloading payloads (e.g., via `curl`) to avoid quarantine controls. Together, the reporting indicates escalating macOS infostealer pressure and corresponding defensive tuning by Apple to better detect script-based tradecraft used to bootstrap these infections.
Jun 29, 2026
Security researchers have identified a new threat vector targeting macOS systems, where stealer malware is being distributed using AppleScript (`.scpt`) files. This technique allows attackers to bypass traditional detection mechanisms by leveraging the scripting capabilities native to macOS, increasing the stealth and effectiveness of malware campaigns against Apple users. The emergence of this vector highlights the evolving tactics of threat actors seeking to compromise macOS environments, which have historically been perceived as more secure than other platforms. In response to the growing sophistication and prevalence of macOS-targeted malware, security experts are developing new tools and datasets to improve detection and defense. Notably, researchers are preparing to release Malet, the largest public dataset of macOS malware, and Katalina, an open-source static analysis tool designed to process large volumes of binaries efficiently. These initiatives aim to address the gap in macOS malware research and provide defenders with better resources to identify and mitigate threats, including those exploiting AppleScript-based attack vectors.
Jun 29, 2026