ProductionBag from com.Apple.AppStore (MZFinance Script)

MZFinance Script

This is one of the primary methods of intrusion used by Grandslam script artists: 

The MZFinance Script.

Found in com.apple.appstore, this pernicious ProductionBag script wreaks havoc on a targeted individual's Mac and iCloud accounts, and apparently records the victim and uploads it to iTunes.

The greater function of this script, and its parts, is to imitate the user on social media and cloud accounts.  In particular, these scripts hack iCloud accounts and create fraudulent GameCenter accounts, as well as fraudulent social media accounts from the user's MAC address.  The Grandslam script is in heavy use throughout America, particularly by law enforcement and "assets" of their networks.

This RAS Automator script (MZFinance) was found on Sierra 10.12.5 on July 7, 2017 in Decatur County, TN.  Previous instances were archived.  Some were reported.

© Copyright 2017, The Cyberculturalist