AmnesiaStealer AppleScript Finder duplicate exfil of Keychains/cookies
Detects an embedded AppleScript using Finder's 'duplicate' command to copy Safari cookies, Notes attachments, and the Keychains folder to a randomly named staging directory, avoiding direct TCC prompts as used by AmnesiaStealer.
Microsoft Sentinel (KQL)
