Curl-piped osascript executing remote AppleScript payload in memory
Detects the use of 'curl' to perform a network request (likely for a remote script) and immediately piping that output to 'osascript' for execution in memory. This pattern is often used to execute malicious AppleScript payloads directly without writing to the disk, a technique seen in recent macOS infostealer campaigns.
Cortex XDR
