Suspicious Access to macOS Keychain

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•14•0•6

Detects potential credential theft attempts targeting macOS Keychain. It identifies the use of the 'security' utility with commands like 'dump-keychain' or 'find-generic-password' and monitors for unauthorized processes accessing files within the 'Library/Keychains' directory.