AppleScript

As click-fix attacks continue to evolve, defenders must focus on detecting suspicious behavior rather than specific malware signatures.

The attacks demonstrate the adaptability of threat actors, who are now using methods like the AppleScript colon slash slash URL scheme to bypass traditional defenses and infect devices with malware like Atomic Stealer.

The rise of click-fix attacks underscores the need for heightened vigilance and improved security measures to protect users from this growing threat.

As attackers continue to refine their techniques, both individuals and organizations must remain proactive in safeguarding their systems against these pervasive attacks.

So last time you came on Security Bite and we spoke, ClickFix was, like, having its heyday, and then I think it was April, Apple instrumented, uh, implemented the terminal warning prompts that a user would get when they accidentally or purposely paste, uh, malicious code into terminal.

Is ClickFix still something that you're seeing today? Is that still something that's being detected, whether it's in AppleScript form where they, like, request to open script editor? Is that something you're seeing?

Yeah.

Yeah.

[laughs] Yeah, he was the first one.

[laughs] And, um, yeah, and after, uh, some time Apple did kind of the same thing, like, uh, when you paste a browser, mm, copied comment in the terminal you get a warning.

Uh, but within weeks, I think two, three weeks after Jamf, uh, found c- campaigns, uh, using the AppleScript, uh, URL scheme to open script editor straight from the browser, uh, yeah, and run it, so the warning, uh, didn't fire that, uh, moment, uh, because terminal wasn't involved.

Um, yeah, so it's, uh, it's all about cat mouse, uh, game all the time.

Sure.

Use AppleScript.

I love AppleScript.

Okay, so back to the iPhone Ultra.

We're expecting two 48-megapixel cameras, an ultra-wide and a... wide camera as the photographers say because it is still wider than most cameras um this is the normal 1x and 2x and 0.5x um so basically like the iphone air 2 that's gonna launch in spring And then we're going to have an Apple Watch Series 12, which the 11 didn't feel like much different.

No.

But if you can run a Moom AppleScript out of, out of Shortcuts in your game-

Yeah

... you know, you're good.

Well, this year not because it's finally...

I think a lot of people that play with AppleScript and shortcuts and Automator, it's like people that are playing with OpenCore.

I think it's a... a hobby, the fun thing is tinkering around with it.

I'm not sure how much in real life these things actually help.

I think the

entire publishing industry ran on AppleScript, and that's one of the reasons that they're still...

People say that.

I've worked

And it's engineered by engineers, not engineered by editors who are trying to figure out how to be engineers enough to build some goofy custom tool.

So what I'm working toward is AppleScripts and Python scripts right in OS, uh, macOS, that will automate and simplify things like, hey, I need to turn a sequence of, uh, 350 PDFs into a, a JPEG in 10 seconds.

That can just be done, you know, with Homebrew and Terminal.

What I wanna do is use ShotGrid with some sort of custom, uh, workflows, Automator stuff, A- AppleScript, and Python scripts to treat each shot as having basically its own essence, kind of thinking of...

But I see you have a lot of really cool headlining features in AirBuddy 3.

And I like how you've both kind of added a whole bunch of features and kind of low-level things as well, like AppleScript support, which is really cool, with that new design and look and feel.

Because it feels like that's when these kinds of releases tend to be the most successful, is when you combine...

some really cool new look like something that you can immediately see that is different with like a lot of new powerful features kind of under the hood so that you get that complete package where it's not just a redesign or it's not just like one or two new features but it just feels kind of like a new product like a proper you know big major release

Yeah.

Um, Mark wrote in and said, "Can you confirm the status of AppleScript and Automator in macOS 27? I have some scripts and folder actions that would've been converted to shortcut workflows and automations if AppleScript and Automator are compromised or feeling like they're going away."

Uh, everything's fine.

Nothing changes.

Nothing changes.

My Automator actions still work.

Um, AppleScript still works.

Uh, Shortcuts adds, you know, Shortcuts has...