Macos Suspicious Script Editor Activity

Tim Peck@timpeck

•updated Nov 12, 2025•5•1•123

Detects the macOS Script Editor (`Script Editor.app`) launching child processes or initiating network connections. This behavior can indicate the execution of a malicious AppleScript used to download secondary payloads or execute arbitrary commands, as seen in campaigns delivering stealers like MacSync and Odyssey.