InfoStealer · Dropper

Essential macOS Stealer - script.sh

Author: Moise Medici
Updated: 10 Sept 2026 · Completed
Difficulty: Easy
Platform: MacOS
Capabilities: Command and Control C2 Communication Command Execution via Powershell Cmd Bash Credential Theft Data-Exfiltration Dropping Secondary Payloads
Tags: bash AppleScript Essential macOS Stealer

Stage1 Code Analysis

The file is an .applescript, so it can be read easily. Its contents are:

1
osascript -e "$(echo "<long string>==" | base64 -d)"

Two things immediately stand out: osascript and base64 -d. The latter is a clear clue that the long string is Base64-decoded (-d), while the former tells us that the sample targets macOS devices. 1

Execute AppleScripts and other OSA language scripts. Executes the given script file, or standard input if none is given. Scripts can be plain text or compiled scripts. osascript was designed for use with AppleScript, but will work with any Open Scripting Architecture (OSA) language.

The string can be decoded as follows:

1
echo "<long string>==" | base64 -d > stage2.applescript