macOS Threat: AppleScript (.scpt) Files Emerge as New Stealth Vector for Stealer Malware

A new macOS threat shows AppleScript (.scpt) files being used as a stealth delivery vector for stealer malware, according to fresh research from Pepe Berba, Threat Detection & Hunting specialist at Canva. The analysis notes a rise in malicious .scpt files masquerading as fake Office documents, Zoom updates, and Teams SDK installers, taking advantage of macOS’s trust in Script Editor and the application’s opening behaviour.

Berba highlights two well-known fallback methods—copy-paste-to-terminal delivery and drag-to-terminal DMGs—but warns that .scpt abuse is the next evolution for convincing attacks. Threat actors now embed malicious payloads inside compiled or plaintext AppleScript files that appear legitimate, delivering stealer malware via deceptive landing pages and fake installers such as MSTeamsUpdate[.]scpt, Zoom SDK Update[.]scpt, InstallSoftZone[.]scpt and Microsoft.TeamsSDK[.]scpt.

The piece also notes that Apple’s Gatekeeper has tightened since August 2024, and that several of these scripts still have zero detections on VirusTotal, while references to commodity malware like Odyssey Stealer and MacSync Stealer suggest a trickle-down of high-grade techniques.