macOS Stealer - Keychain Extraction via Security Tool

Ibrahim Saud@tektrix

•updated Jun 22, 2026•0•0•1

Identifies the payload invoking the native macOS security command-line utility to dump passwords and certificates from the user's Keychain, specifically when the initiating process is located in the /tmp/ directory, which is often used by malware for temporary execution.