I see this isn't a brand new attack but one that I hadn't seen before. It's quite slick.
Threat Actors Use Clickfix Tactics to Deploy Malicious AppleScripts for Stealing Login Credentials
The CYFIRMA research team has identified a sophisticated cybercrime campaign leveraging Clickfix tactics to deliver malicious AppleScripts.
cyberpress.org
September 2, 2025 at 3:49 PM
I see this isn't a brand new attack but one that I hadn't seen before. It's quite slick.
Bad idea Friday: I made an MCP server that lets Claude run applescripts on my computer.
July 4, 2025 at 4:26 PM
Bad idea Friday: I made an MCP server that lets Claude run applescripts on my computer.
Apple nerds, I need help! For years I’ve used AppleScripts to tell Ableton Live to save so that I can open a new file with a midi command. That stopped working when I upgraded to OS 14.7. When I test my ancient scripts I get a new error that ScriptEditor can’t send keystrokes. Anyone know the fix?
May 14, 2025 at 11:12 PM
Apple nerds, I need help! For years I’ve used AppleScripts to tell Ableton Live to save so that I can open a new file with a midi command. That stopped working when I upgraded to OS 14.7. When I test my ancient scripts I get a new error that ScriptEditor can’t send keystrokes. Anyone know the fix?
Been a while since we've seen #macOS #malware abusing osacompile rather than plain osascript, but #Amos Atomic Stealer is nothing if not adaptable. SHA1: 51ef05c84eea3dde149a5dd3ea9916a824e95afc.
A reminder that it's possible (didn't say easy 😅) to reverse compiled #applescript.
s1.ai/fadedead
A reminder that it's possible (didn't say easy 😅) to reverse compiled #applescript.
s1.ai/fadedead
FADE DEAD | Adventures in Reversing Malicious Run-Only AppleScripts - SentinelLabs
We show how to statically reverse run-only AppleScripts for the first time, and in the process reveal new IoCs of a long-running macOS Cryptominer campaign.
s1.ai
November 21, 2024 at 11:26 AM
Been a while since we've seen #macOS #malware abusing osacompile rather than plain osascript, but #Amos Atomic Stealer is nothing if not adaptable. SHA1: 51ef05c84eea3dde149a5dd3ea9916a824e95afc.
A reminder that it's possible (didn't say easy 😅) to reverse compiled #applescript.
s1.ai/fadedead
A reminder that it's possible (didn't say easy 😅) to reverse compiled #applescript.
s1.ai/fadedead
I made (err, vibe-coded as the kids say) a recording light for my home studio! I used:
◉ Wyze smart plug
◉ Claude Desktop
◉ A couple AppleScripts
◉ IFTT
◉ A recording LED neon light my wife got me for Christmas
Def different ways to do this, but I used what I had!
www.youtube.com/shorts/Mmm1V...
◉ Wyze smart plug
◉ Claude Desktop
◉ A couple AppleScripts
◉ IFTT
◉ A recording LED neon light my wife got me for Christmas
Def different ways to do this, but I used what I had!
www.youtube.com/shorts/Mmm1V...
January 25, 2026 at 10:56 PM
I made (err, vibe-coded as the kids say) a recording light for my home studio! I used:
◉ Wyze smart plug
◉ Claude Desktop
◉ A couple AppleScripts
◉ IFTT
◉ A recording LED neon light my wife got me for Christmas
Def different ways to do this, but I used what I had!
www.youtube.com/shorts/Mmm1V...
◉ Wyze smart plug
◉ Claude Desktop
◉ A couple AppleScripts
◉ IFTT
◉ A recording LED neon light my wife got me for Christmas
Def different ways to do this, but I used what I had!
www.youtube.com/shorts/Mmm1V...
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper:
pberba.github.io/security/202...
#macOS #infosec #applescript #cybersecurity #exploitation #hacking
pberba.github.io/security/202...
#macOS #infosec #applescript #cybersecurity #exploitation #hacking
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper
A look at how threat actors are abusing AppleScript .scpt files to deliver macOS malware, from fake documents to browser update lures, and how these scripts ...
pberba.github.io
November 30, 2025 at 6:22 PM
MacOS Infection Vector: Using AppleScripts to bypass Gatekeeper:
pberba.github.io/security/202...
#macOS #infosec #applescript #cybersecurity #exploitation #hacking
pberba.github.io/security/202...
#macOS #infosec #applescript #cybersecurity #exploitation #hacking
macOS 26.4’s Script Editor Won’t Open Some Older AppleScripts:
mjtsai.com/blog/2026/03... #mjtsaiblog
mjtsai.com/blog/2026/03... #mjtsaiblog
Michael Tsai - Blog - macOS 26.4’s Script Editor Won’t Open Some Older AppleScripts
mjtsai.com
March 27, 2026 at 9:28 PM
macOS 26.4’s Script Editor Won’t Open Some Older AppleScripts:
mjtsai.com/blog/2026/03... #mjtsaiblog
mjtsai.com/blog/2026/03... #mjtsaiblog
Imagine trying to explain macros and AppleScripts to the kids though
🔥🔥🔥🔥🔥
May 26, 2025 at 9:30 PM
Imagine trying to explain macros and AppleScripts to the kids though
Can we make it work with AppleScripts? This is my concern as well
November 23, 2024 at 8:03 PM
Can we make it work with AppleScripts? This is my concern as well
This new XCSSET variant improves browser targeting, clipboard hijacking, and persistence mechanisms. It employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealth, and expands data exfiltration capabilities.
September 25, 2025 at 3:09 PM
This new XCSSET variant improves browser targeting, clipboard hijacking, and persistence mechanisms. It employs sophisticated encryption and obfuscation techniques, uses run-only compiled AppleScripts for stealth, and expands data exfiltration capabilities.
A book industry blogger I admired twenty years ago wrote a suite of AppleScripts to scrub redundant whitespace and sub in proper quotation marks and dashes. By now that functionality ought to be standard issue word processing tooling customizable to match house style
July 7, 2025 at 1:47 AM
A book industry blogger I admired twenty years ago wrote a suite of AppleScripts to scrub redundant whitespace and sub in proper quotation marks and dashes. By now that functionality ought to be standard issue word processing tooling customizable to match house style
Whoa, you can write AppleScripts on iOS?
August 3, 2026 at 12:44 AM
Whoa, you can write AppleScripts on iOS?
Radiologik and some creative applescripts have been a solid option!
December 18, 2025 at 6:30 AM
Radiologik and some creative applescripts have been a solid option!
mostly it does what spotlight does — app launcher and non-hierarchical file search. but it also has composable actions and a great "trigger" system that lets you assign global hotkeys to applescripts or whatever.
July 20, 2025 at 3:15 AM
mostly it does what spotlight does — app launcher and non-hierarchical file search. but it also has composable actions and a great "trigger" system that lets you assign global hotkeys to applescripts or whatever.
I think my data science scripts in 1995 were applescripts connecting a data source in Excel or Filemaker to Adobe Illustrator for plotting maps. It was a few more years before I began processing data in python.
October 12, 2025 at 12:46 AM
I think my data science scripts in 1995 were applescripts connecting a data source in Excel or Filemaker to Adobe Illustrator for plotting maps. It was a few more years before I began processing data in python.
::: sits down to read email >notices forum post about Jung, Shadow Self, and ADHD > opens Youtube to investigate >decides to re-arrange windows to watch said videos >spends the next hour chatting with Claude to build applescripts :::
Good thing I ran out of Claude prompts. Safe till 2 pm!
#adhd
Good thing I ran out of Claude prompts. Safe till 2 pm!
#adhd
April 8, 2025 at 1:59 PM
::: sits down to read email >notices forum post about Jung, Shadow Self, and ADHD > opens Youtube to investigate >decides to re-arrange windows to watch said videos >spends the next hour chatting with Claude to build applescripts :::
Good thing I ran out of Claude prompts. Safe till 2 pm!
#adhd
Good thing I ran out of Claude prompts. Safe till 2 pm!
#adhd
Today I am feeling powerful. I created two AppleScripts, saved them as applications. Then added them as buttons on my StreamDeck.
Now with a single push of a button I can stream my local public radio station.
The other button automatically plays a particular Spotify playlist.
#FeelingPowerful
Now with a single push of a button I can stream my local public radio station.
The other button automatically plays a particular Spotify playlist.
#FeelingPowerful
January 17, 2024 at 3:37 PM
Today I am feeling powerful. I created two AppleScripts, saved them as applications. Then added them as buttons on my StreamDeck.
Now with a single push of a button I can stream my local public radio station.
The other button automatically plays a particular Spotify playlist.
#FeelingPowerful
Now with a single push of a button I can stream my local public radio station.
The other button automatically plays a particular Spotify playlist.
#FeelingPowerful
I’m also happy to report macOS Golden Gate didn’t break any of my AppleScripts, shell scripts, shortcuts, custom daemons, or hardware drivers. Amazingly. Every year I wince as I update, assuming my bespoke mac setup will break in 1000 different ways. But it all seems good.
September 16, 2026 at 11:51 PM
I’m also happy to report macOS Golden Gate didn’t break any of my AppleScripts, shell scripts, shortcuts, custom daemons, or hardware drivers. Amazingly. Every year I wince as I update, assuming my bespoke mac setup will break in 1000 different ways. But it all seems good.
(to be clear those last two are just applescripts i wrote; anything that lets you assign global hotkeys would work. but it does that well.)
July 20, 2025 at 3:20 AM
(to be clear those last two are just applescripts i wrote; anything that lets you assign global hotkeys would work. but it does that well.)
A conversation about automating lights for meetings, plus reviewing my “tech things to try” list, led to me trying out the Mac automation tool Hammerspoon.
Now I have much nicer light automation and Zoom mute state tools than I ever had with applescripts and shell scripts!
www.hammerspoon.org
1/
Now I have much nicer light automation and Zoom mute state tools than I ever had with applescripts and shell scripts!
www.hammerspoon.org
1/
Hammerspoon
Staggeringly powerful macOS desktop automation with Lua. Making the runtime, funtime.
www.hammerspoon.org
February 19, 2024 at 3:20 AM
A conversation about automating lights for meetings, plus reviewing my “tech things to try” list, led to me trying out the Mac automation tool Hammerspoon.
Now I have much nicer light automation and Zoom mute state tools than I ever had with applescripts and shell scripts!
www.hammerspoon.org
1/
Now I have much nicer light automation and Zoom mute state tools than I ever had with applescripts and shell scripts!
www.hammerspoon.org
1/
The version that I saw appears to have been Odyssey Stealer or a variant, as described here. I don't know enough about these attacks to know whether it's related to Lumma Stealer.
Threat Actors Use Clickfix Tactics to Deploy Malicious AppleScripts for Stealing Login Credentials
The CYFIRMA research team has identified a sophisticated cybercrime campaign leveraging Clickfix tactics to deliver malicious AppleScripts.
cyberpress.org
September 3, 2025 at 9:37 PM
The version that I saw appears to have been Odyssey Stealer or a variant, as described here. I don't know enough about these attacks to know whether it's related to Lumma Stealer.
I wrote some macOS scripts to quickly trim white space from 4x6" shipping label PDFs, and quickly format them and then print to my 4x6 label printer. It's not very clever about the cropping (opens it in Preview if unsure), but perhaps it might be useful to someone else?
useful-scripts/crop-and-print-label/readme.md at main · swizzlevixen/useful-scripts
Applescripts, shell scripts, python, etc., that are handy-dandy helpers that do useful things - swizzlevixen/useful-scripts
github.com
July 21, 2025 at 8:00 PM
I wrote some macOS scripts to quickly trim white space from 4x6" shipping label PDFs, and quickly format them and then print to my 4x6 label printer. It's not very clever about the cropping (opens it in Preview if unsure), but perhaps it might be useful to someone else?
In this week's issue of MacAdmins.news, we consider Snow Leopard nostalgia, discuss LLM use, learn how AppleScripts are used in Malware, and celebrate a new open source PSSO app!
macadmins.news/issues/384
#Mac #MacAdmins #Apple
macadmins.news/issues/384
#Mac #MacAdmins #Apple
MacAdmins.news
A weekly summary of news, blog posts, updates and other links for Apple device management and security professionals, curated by Armin Briegel of Scripting OS X.
MacAdmins.news
November 28, 2025 at 3:17 PM
In this week's issue of MacAdmins.news, we consider Snow Leopard nostalgia, discuss LLM use, learn how AppleScripts are used in Malware, and celebrate a new open source PSSO app!
macadmins.news/issues/384
#Mac #MacAdmins #Apple
macadmins.news/issues/384
#Mac #MacAdmins #Apple
Lookaway 1.11 update introduces Automations for AppleScripts, Siri Shortcuts, and macOS Focus Filters. It enhances security, workflow, and video playback detection, and redesigns the break countdown interface
buff.ly
March 20, 2025 at 1:01 AM
Lookaway 1.11 update introduces Automations for AppleScripts, Siri Shortcuts, and macOS Focus Filters. It enhances security, workflow, and video playback detection, and redesigns the break countdown interface