SHub Stealer Password Validation via DSCL

Tim Peck@timpeck

•updated Feb 11, 2026•2•0•42

Detects the use of 'dscl . authonly' to validate user passwords, a technique used by the SHub Stealer malware to verify credentials before exfiltration. The malware typically executes this command from a shell or AppleScript interpreter.