Meow RAT Fileless AppleScript Execution via curl Pipe to osascript on macOS

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects instances where 'osascript' is used to execute commands that include suspicious keywords often associated with obfuscated or malicious scripts. This can indicate an attempt to run arbitrary code, potentially for initial access, execution, or persistence on macOS systems.