macOS Password Harvesting via osascript

Danny Y@zendannyy

•updated Jun 13, 2026•2•0•12

Detects AppleScript execution attempting to harvest user passwords through dialog boxes with hidden answer parameters. This technique is commonly used by macOS infostealers like Poseidon and Banshee.