macOS osascript fake credential prompt dialog

Kaung Khant Ko@kaungkhantko

•updated Aug 10, 2026•8•0•18

This rule detects the use of 'osascript' on macOS to generate a fake credential prompt dialog. It specifically looks for AppleScript commands containing keywords such as 'display dialog', 'password', and either 'with hidden answer' or 'Enter your password'. This behavior is characteristic of an adversary attempting to phish user credentials by presenting a legitimate-looking prompt.