Phexia macOS ~/.passphrase and ~/.txid artifact written by osascript lineage

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•0

Detects potential credential theft and staging on macOS where plaintext login credentials are written to disk (~/.passphrase and ~/.txid) by osascript or related shell processes, often accompanied by or following a local dscl authonly check.