Counterfeit Gatekeeper 'Damaged App' Dialog Shown by PamStealer Post-Credential Capture

Duo Tech@duotech

•updated Jul 6, 2026•1•0•1

This rule detects command-line execution or activity containing specific strings associated with a fake 'damaged application' dialog box on macOS. This behavior is indicative of the PamStealer malware or similar social engineering campaigns that attempt to deceive users into believing their application is corrupt, thereby tricking them into interacting with malicious artifacts.