macOS Keychain Access Tool Delivered via HTTP

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•3

This rule detects the delivery of a macOS Keychain Access tool via HTTP. It specifically looks for the string "SecKeychainFindInternetPassword" within the file data of HTTP traffic flowing from the server to the client. This string is indicative of an application attempting to access or manipulate macOS Keychain passwords, suggesting the presence of malware or a malicious utility designed to extract credentials.