Fake 'Installer' NSAlert password phishing prompt (unsigned/ad-hoc)

Duo Tech@duotech

•updated Aug 19, 2026•0•0•4

Detects a spoofed 'Installer wants to make changes' password prompt dispatched from an unsigned or ad-hoc-signed process, used by AmnesiaStealer to phish the victim's macOS login/keychain password.