[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"framework:mitre-attack\u002Ft1555-001":3},{"item":4,"lessons":18,"controls":44,"related":72},{"family":5,"item":6,"code":7,"title":8,"citations":9,"publisher":10,"summary_md":11,"official_text":12,"official_attribution":13,"official_url":14,"link_label":15,"note":16,"updated_at":17},"mitre-attack","t1555-001","T1555.001","Keychain",6,"MITRE","**What attackers do.** Attackers access the macOS Keychain, the system store for passwords, certificates and keys, to obtain saved credentials. This serves the Credential Access tactic.\n\n**How to defend.** Keep macOS updated, use endpoint protection that monitors Keychain access, and restrict admin rights. Use mobile device management to enforce security settings, and prefer an enterprise password manager for corporate credentials. Lock screens promptly and require the user password for Keychain access, which makes silent extraction harder. Collect macOS unified logs and endpoint telemetry centrally so access attempts can be reviewed alongside other activity.\n\n**Signs to look for.** Look for command-line tools or unknown processes querying the Keychain, copies of Keychain files and repeated password prompts that users did not expect. A common gap is weaker endpoint monitoring on macOS compared with Windows.","Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service. \n\nKeychains can be viewed and edited through the Keychain Access application or using the command-line utility `security`. Keychain files are located in `~\u002FLibrary\u002FKeychains\u002F`, `\u002FLibrary\u002FKeychains\u002F`, and `\u002FNetwork\u002FLibrary\u002FKeychains\u002F`.\n\nAdversaries may gather user credentials from Keychain storage\u002Fmemory. For example, the command `security dump-keychain –d` will dump all Login Keychain credentials from `~\u002FLibrary\u002FKeychains\u002Flogin.keychain-db`. Adversaries may also directly read Login Keychain credentials from the `~\u002FLibrary\u002FKeychains\u002Flogin.keychain` file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.","© The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation (MITRE ATT&CK®).","https:\u002F\u002Fattack.mitre.org\u002Ftechniques\u002FT1555\u002F001\u002F","Open the technique on MITRE ATT&CK",null,"2026-10-18T15:18:43.663+00:00",{"total":9,"list":19},[20,24,28,32,36,40],{"slug":21,"title":22,"published_at":23},"clickfix-macos-malware-silently-steals-crypto-via-social-engineering","ClickFix macOS Malware Silently Steals Crypto via Social Engineering","2026-08-07T00:20:24.21+00:00",{"slug":25,"title":26,"published_at":27},"clicklock-macos-malware-tricks-users-into-surrendering-login-passwords-via-social-engineering","ClickLock macOS Malware Tricks Users Into Surrendering Login Passwords via Social Engineering","2026-07-16T22:20:24.855+00:00",{"slug":29,"title":30,"published_at":31},"clicklock-macos-stealer-coerces-passwords-through-app-killing-pressure-loop","ClickLock macOS Stealer Coerces Passwords Through App-Killing Pressure Loop","2026-07-16T14:21:58.481+00:00",{"slug":33,"title":34,"published_at":35},"crashstealer-malware-masquerades-as-apple-crash-reporting-tool","CrashStealer Malware Masquerades as Apple Crash Reporting Tool","2026-07-13T20:20:57.194+00:00",{"slug":37,"title":38,"published_at":39},"macos-clickfix-campaign-tricks-users-into-running-malicious-terminal-commands","macOS ClickFix Campaign Tricks Users Into Running Malicious Terminal Commands","2026-06-23T20:21:31.569+00:00",{"slug":41,"title":42,"published_at":43},"amos-stealer-harvests-macos-credentials-via-social-engineering","Amos Stealer Harvests macOS Credentials via Social Engineering","2026-06-16T18:21:25.266+00:00",[45,49,54,59,64,68],{"slug":46,"name":47,"problem":48,"stories":9},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":50,"name":51,"problem":52,"stories":53},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",5,{"slug":55,"name":56,"problem":57,"stories":58},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",2,{"slug":60,"name":61,"problem":62,"stories":63},"application-allowlisting","Application allowlisting","Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.",1,{"slug":65,"name":66,"problem":67,"stories":63},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",{"slug":69,"name":70,"problem":71,"stories":63},"dns-web-filtering","DNS filtering and secure web gateway","Users cannot reach known-malicious sites, and malware cannot phone home.",[73,78,83,87,92,97,102,106],{"family":74,"item":75,"code":76,"title":77,"together":9},"nist-800-53","si-3","SI-3","Malicious Code Protection",{"family":79,"item":80,"code":81,"title":82,"together":9},"nist-csf","de-cm","DE.CM-1","Continuous Monitoring",{"family":74,"item":84,"code":85,"title":86,"together":9},"au-12","AU-12","Audit Record Generation",{"family":88,"item":89,"code":90,"title":91,"together":9},"gdpr","32","Article 32","Security of processing",{"family":93,"item":94,"code":95,"title":96,"together":53},"cis","14","Control 14","Security Awareness and Skills Training",{"family":74,"item":98,"code":99,"title":100,"together":101},"ac-3","AC-3","Access Enforcement",4,{"family":74,"item":103,"code":104,"title":105,"together":101},"at-2","AT-2","Literacy Training and Awareness",{"family":93,"item":107,"code":108,"title":109,"together":110},"3","Control 3","Data Protection",3]