Meow RAT Fake System Preferences Dialog Harvesting macOS Password via osascript

Ibrahim Saud@tektrix

•updated Jun 23, 2026•0•0•1

Detects the execution of 'osascript' with command-line arguments indicative of malicious activity, such as attempting to access locked icons, using 'dscl . authonly' for authentication, or displaying hidden dialogs for credential harvesting. This often points to AppleScript abuse for various attack techniques.