macOS - Fake System Password Prompt via AppleScript

Ethan Andrews@eandrews

•updated Feb 24, 2026•9•0•110

Detects the execution of 'osascript' to display a deceptive system dialog box mimicking a 'System Preferences' password prompt. This technique is used by malware like the Atomic macOS Stealer (AMOS) to trick users into entering their administrative password for credential theft.