AmnesiaStealer dscl -authonly followed by sudo -S -v within short window

Duo Tech@duotech

•updated Aug 19, 2026•3•0•7

Detects local validation of a phished password via dscl -authonly immediately followed by sudo -S -v in a short time window, matching AmnesiaStealer's technique for confirming captured credentials are valid before reuse.