macOS Fake Helper Prompt Validates Stolen Password via dscl -authonly

Duo Tech@duotech

•updated Aug 7, 2026•1•0•1

Detects unauthorized credential validation attempts on macOS using the 'dscl -authonly' command. The rule identifies instances where suspicious interpreter processes (like bash, zsh, python, or curl) or their derivatives attempt to validate credentials via the Directory Service Command Line tool, while excluding known legitimate system and management processes.