AMOS Keychain Harvesting via security find-generic/internet-password

Ibrahim Saud@tektrix

•updated Jun 24, 2026•2•0•6

Detects execution of the macOS 'security' utility to harvest generic or internet passwords from the Keychain, a technique commonly associated with the AMOS (Atomic macOS Stealer) infostealer for credential theft.