AppleScript Used to Deliver macOS Malware Disguised as Zoom & Teams Updates

AppleScript is being used to deliver macOS malware, with threat actors disguising payloads as Zoom and Microsoft Teams updates to bypass security controls. Since Apple removed the Gatekeeper override for right-click and open in August 2024, attackers have shifted to AppleScript (.scpt) files that can execute malicious payloads when users double‑click or run them, often aided by social engineering.

Script Editor remains a legitimate macOS application, so scripts can appear less suspicious as infection chains unfold, with attackers hiding malicious code behind blank lines and convincing fake document or installer icons. The technique has spread from advanced threat actors to commodity malware families, with examples including Odyssey Stealer and MacSync Stealer, and has been used to mass‑distribute fake update installers for Teams, Zoom, and other popular apps through phishing websites.

VirusTotal analyses show many malicious .scpt files evading detection, and attackers increasingly rely on weaponized scripts embedded in fake documents and installers delivered via ZIP or DMG archives. Threat actors also use convincing icons and fake file types to increase the likelihood of execution, and security teams are advised to change default handling for .scpt files and monitor for obfuscated command patterns.