Meow RAT macOS Keychain credential theft via osascript and security binary
Detects unauthorized usage of the 'osascript' command to interact with the 'security' binary on macOS, specifically targeting keychain operations such as dumping, finding generic passwords, or unlocking the login keychain. This behavior is indicative of Meow RAT attempting to exfiltrate credentials from the macOS Keychain or browser-stored secrets.
YARA-L
