FADE DEAD: Adventures in Reversing a Malicious macOS Coin Miner Using Run-Only AppleScripts
released on 2021-01-12 @ 05:04:42 PM
Security researchers at Sentinel Labs have revealed details about macOS.OSAMiner, which has been circulating in the wild since 2018, using run-only AppleScripts. Additionally, Sentinel Labs released their open source AEVT decompiler tool to aid other researchers in the analysis of malicious run-only AppleScripts.