CrashStealer: Login keychain database file copied from ~/Library/Keychains

Duo Tech@duotech

•updated Jul 14, 2026•1•0•3

Detects processes other than the authorized system processes ('security' and 'securityd') interacting with the login.keychain-db file. Adversaries often target this file to extract stored credentials from the macOS keychain.