T1056.002

Input Capture: GUI Input Capture

discovered 2026-07-22

Fake native macOS password dialog ('Please enter your password to continue', titled 'macOS' with system lock icon) loops until the entry validates against the real account via dscl . authonly, with a 150s per-attempt timeout.

View on MITRE ATT&CK

Seen in packages

Campaigns