Bypass Record
Masquerading × Apple macOS
A publicly-reported instance of Masquerading bypassing Apple macOS, recorded with its original source. Factual record; no assessment of any specific deployment.
Mechanism
The malware leverages the applescript:// URL scheme to open macOS Script Editor pre-populated with a malicious AppleScript. This bypasses Terminal-based execution and sidesteps Apple's Transparency, Consent, and Control (TCC) 26.4 mitigations that would normally block such script execution flows.
Detection & mitigation
Monitor for execution of Script Editor (osascript or Script Editor.app) with suspicious URL scheme invocations (e.g., applescript://) from non-interactive processes or browsers. Enforce application control policies to block or alert on applescript:// URL handling and restrict Script Editor execution via MDM.
This is a record of a publicly-reported event, not an assessment of any specific organization's deployment. Detection and mitigation notes are drawn from the cited source. Where the source is silent, fields are omitted.