Meow Stealer Browser Credential Theft via osascript on macOS

Ibrahim Saud@tektrix

•updated Jun 23, 2026•1•0•11

This rule detects attempts by common scripting or utility processes (like osascript, curl, zsh, bash, sh, python) to access sensitive macOS files, specifically targeting browser data (Chrome, Brave, Firefox) and keychain files. This activity could indicate an attacker attempting to exfiltrate credentials, session tokens, or other sensitive user data.