CrashStealer: Login keychain unlocked via security unlock-keychain command

Duo Tech@duotech

•updated Jul 14, 2026•1•0•4

Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.