AMOS Fake System Preferences Dialog via osascript and dscl -authonly

Ethan Andrews@eandrews

•updated Jun 23, 2026•1•0•10

Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.