Ad-hoc codesign of dropped bundle spawned via Script Editor (sh/bash)

Duo Tech@duotech

•updated Jul 6, 2026•2•0•1

Detects the 'codesign' utility being invoked with flags '-fs' (force sign) and '--deep' (recursively sign) triggered by a shell process spawned from 'Script Editor'. This pattern is often used to bypass macOS Gatekeeper or attempt to re-sign malicious applications after tampering.