macOS PamStealer: pkill of browser Helper processes followed by KcHelper credential harvest

Arnold Chan@slaz

•updated Sep 25, 2026•0•0•2

Detects PamStealer-style browser credential theft on macOS. The detection logic identifies the forced termination of browser helper processes using 'pkill' (which releases SQLite file locks) followed by the execution of a 'KcHelper' binary that uses specific environment markers (e.g., KC_PASS) to bypass keychain authorization prompts and steal stored browser credentials.