T1056.002
Input Capture: GUI Input Capture
discovered 2026-07-22Fake native macOS password dialog ('Please enter your password to continue', titled 'macOS' with system lock icon) loops until the entry validates against the real account via dscl . authonly, with a 150s per-attempt timeout.
View on MITRE ATT&CK