Encoded ZSH Cache Phishing Dump

Ibrahim Saud@tektrix

•updated Jun 20, 2026•3•0•11

Detects the sudo phishing routine writing the XOR-encoded stolen macOS user password to the hidden ~/.zsh_cache file.