cocomelonc.github.ioPublished
MacOS malware persistence 11: osascript LOLBin. Simple C example
By cocomelonc
Excerpt
﷽
Hello, cybersecurity enthusiasts and white hackers!
osascriptPermalink
osascript lives at /usr/bin/osascript and is present on every macOS including Monterey and Sonoma. Its job is to execute AppleScript or JXA scripts - but it also accepts inline expressions via the -e flag, which is what we exploit.
Check availability:
which osascript…
The opening of the report, shown for reference. The full report, with its figures and indicators, is published by cocomelonc.github.io on cocomelonc.github.io.
Mentioned in the excerpt
On the same topics
- Lorem Ipsum Revisited: ClickFix Pivot & Rapid BrigantineBlueVoyant · Added 25 Oct
- From PostCSS Masquerading to Windows RATJFrog · Published 22 Jun
- Showboat Malware: Emerging Threats Targeting Telecom ProvidersLumen Black Lotus Labs · Added 25 Oct
- International law enforcement initiate hunt on malware group SocGholishDutch National Police · Published 18 Jun