AppleScript was originally developed to automate certain tasks in Apple systems. However, the Pirrit threat managed to use it to inject JavaScript payloads into browsers. To perform code injection, the osascript command-line tool can be used. Here are snippets with examples for different browsers:
- Safari:
tell application "Safari" to do JavaScript "<payload>" in current tab of first window
- Chrome:
tell application "Google Chrome" to execute front window's active tab JavaScript "<payload>"
Apart from this, it is possible to use osascript for other purposes; for example, CookieMiner used it to set up environments before delivering other modules, as you can see here:
Figure 10: The first-stage payload of the CookieMiner threat misusing the osascript functionality
In the next section, we will explore API hijacking for iOS devices in more detail.