Abuse of osascript for Deceptive UI Prompts on macOS

Adversaries are leveraging the native macOS osascript utility to conduct social engineering campaigns by displaying fake system alerts and credential-harvesting dialogs. By executing AppleScript commands through osascript, attackers can create professional-looking pop-up windows that mimic legitimate macOS system messages or security update notifications. These prompts use deceptive keywords such as "authentication," "security update," "system error," and "password" to create a sense of urgency, pressuring the user to enter sensitive information or credentials. This technique is a documented method for credential theft and potential privilege escalation, as users may be tricked into performing actions that grant the attacker unauthorized access or elevated permissions. Defenders should monitor for suspicious command-line arguments passed to osascript that match these UI-centric patterns.

Impact

The abuse of osascript for deceptive prompts allows adversaries to bypass traditional defenses by manipulating the end-user rather than exploiting software vulnerabilities. If successful, this can lead to the harvesting of plaintext credentials, unauthorized MFA tokens, or user-approved execution of malicious payloads, potentially resulting in full compromise of the local macOS endpoint.

Recommendation

• Deploy process-level monitoring on macOS endpoints to capture the full command line of all osascript executions.
• Implement the detection rule below in your SIEM to flag suspicious osascript command arguments.
• Review the parent process and the identity of the user executing osascript to differentiate between malicious social engineering and legitimate administrative or MDM-driven alerts.
• Integrate osquery telemetry with the organization's security data models to provide consistent visibility into process-creation events across macOS assets.