Macos Odyssey Stealer Dscl Authonly

Drew Pilarski@barnabysDrew

•updated Aug 22, 2025•1•4•49

Detects the execution of 'dscl . authonly' by a script interpreter, a technique used by Odyssey Stealer to validate user passwords obtained from a malicious dialog prompt.