AMOS Fake System Preferences Password Dialog via osascript and dscl -authonly

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•5

Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.