L0Psec

@l0psec · Twitter · 2026-07-14 15:07 UTC

Quick one from a share by @malwrhunterteam: d44dafd48ec502e2512076ad1d66209059511292413123f87965011d5d96262e - (6 VT hits) compiled readonly AppleScript - annoying... but there are some interesting parts to cover. This look familiar. Starting with the URL that is in reverse. 🧵