Fake NSAlert Password Prompt Impersonating System Authorization (PamStealer/Maccy)

Duo Tech@duotech

•updated Jul 6, 2026•2•0•1

Detects the execution of processes that display a fake password prompt masquerading as system utilities like Maccy or Finder. This behavior is indicative of credential phishing or a social engineering attempt to steal user credentials by prompting for a password under the guise of a system update or configuration change.