Fake macOS System Preferences Dialog for Password Phishing

Tim Peck@timpeck

•updated Feb 24, 2026•2•0•47

Detects the execution of osascript to display a deceptive dialog box mimicking 'System Preferences' to harvest user passwords. This technique was observed being used by the Atomic Stealer (AMOS) malware.