AMOS Fake System Preferences Dialog via osascript and dscl

nomit vyas@xoxo

•updated Jun 24, 2026•0•0•7

Detects AMOS malware presenting a fake System Preferences password dialog via osascript to harvest user credentials, followed by validation using dscl -authonly. This is a key technique in the macOS ClickFix campaign delivering Atomic macOS Stealer.