macOS Keychain Chrome Master Key Theft via Scripted security find-generic-password

Duo Tech@duotech

•updated Jul 24, 2026•2•0•10

Detects scripted use of the macOS 'security find-generic-password' command targeting the Chrome Keychain item from a shell or unsigned temp-directory parent process, consistent with BlueNoroff's post-ClickFix Keychain master-key theft technique.