Amos Stealer osascript macOS Keychain Unlocking and Credential Extraction

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects attempts to access macOS Keychain items using 'osascript' executed from common shell processes. This activity can indicate an adversary attempting to steal credentials or other sensitive information stored in the Keychain.