Script Editor spawns sh/bash to ad-hoc sign staged fake-app bundle

Duo Tech@duotech

•updated Jul 6, 2026•1•0•1

Detects the use of 'codesign' by 'Script Editor' on macOS to sign files within the '/Library/Application Support/' directory. This behavior is indicative of potential malicious activity, such as attempting to bypass Gatekeeper or signing tampered application files to maintain persistence or evade security controls.