On: macOS malware used run-only AppleScripts to avoid detection for five years

[jandrese]

In this case yes. From the headline I thought there was some kind of weird Apple permission thing where you could mark a binary as unreadable but somehow could still be run to evade malware detection, but it seems like this technical article author is just unfamiliar with the concept of compiling.

[cbhl → jandrese]

It looks like "run-only" is a term-of-the-art in AppleScript, since that label appears on the UI that generates such binaries.

[hundchenkatze → cbhl]

EDIT: Whoops I misread, I thought you were saying that "run-only" was just a flag of sorts.

osacompile[0] does actually produce some form of bytecode when you pass the "x" execute only flag.

Here's a script that opens Safari[1] and the compiled output[2].

[0] https://ss64.com/osx/osacompile.html

[1] https://pastebin.com/raw/u94cwDj7

[2] https://pastebin.com/raw/9uuF39jW

[jmt_ → cbhl]

Right, looks like you could choose to distribute an editable version of a script or a compiled version: https://superuser.com/a/14765