Script Editor
Script Editor is Apple's built-in application for writing, compiling and running AppleScript and JavaScript for Automation (JXA) scripts. It registers the applescript URL scheme, so a link in a web page can open Script Editor with script text already filled in. Attackers have used this in ClickFix-style campaigns to move the user-run step out of Terminal, which sidesteps the paste warning that macOS Tahoe 26.4 applies to terminal emulators but not the rest of the 26.4 protections. macOS scans AppleScript and JXA execution through the OpenScripting framework, recent Tahoe builds prompt the user to allow the script to be saved before it runs, and the user still has to let the browser open Script Editor and then click Run.
Paths
/System/Applications/Utilities/Script Editor.app/Contents/MacOS/Script Editor Example Use Cases
Open a pre-filled script from a web page via the applescript URL scheme #
A malicious web page opens an applescript URL, which launches Script Editor with attacker-supplied script text in a new document. The user is told to click Run. Jamf Threat Labs (Atomic Stealer) and SentinelOne (SHub Reaper) observed this. Neither report publishes the campaign URL. The code shown comes from the application's URL handler and is not a published indicator.
applescript://com.apple.scripteditor?action=new&script=<URL-ENCODED_APPLESCRIPT>Detections
- Script Editor launched from a browser-handled applescript URL, followed by shell or network activity
- Unexpected AppleScript or osascript activity after Script Editor execution