Amos Stealer Browser Credential Harvesting via osascript on macOS

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects suspicious process activity involving common macOS command-line tools (osascript, sh, bash, zsh, cp) attempting to access sensitive browser data (Chrome, Edge login data, cookies, web data) or macOS keychain files. This rule specifically excludes activity initiated by the browsers themselves to reduce false positives.