Script Editor launches malicious Maccy.scpt disguised as clipboard manager

Duo Tech@duotech

•updated Jul 6, 2026•1•0•1

Detects the execution of AppleScript files named 'Maccy.scpt' using the 'osascript' or 'Script Editor' utilities. The rule correlates this process execution with network activity directed towards the 'maccyapp.com' domain within a one-hour window, identifying potential unauthorized or malicious scripting behavior involving Maccy-related artifacts.