Phexia macOS stealer Safe Storage key reads and /tmp staging from osascript

ills3c Intel&Coffee@Ills3C

•updated yesterday•1•0•1

Detects Phexia macOS stealer activity where osascript or shell processes query the macOS keychain for browser Safe Storage keys, followed by staging browser and extension data in temporary directories.