Command and Scripting Interpreter: AppleScript

macOS payload is a 707-line AppleScript/JXA stage decrypted from payload.enc and executed via osascript, never written to disk as a separate file.