LiveActive security incident?Get immediate response
MITRE ATT&CK® Technique

T1555.001: Keychain

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.[1][2][3]

Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.[4][5]

EnterpriseT1555.001Sub-techniqueObject v1.1Modified
Discuss defensive coverageBack to ATT&CK
Glexia's Take · Automated analysis

Security context for executives and security teams

Automation confidenceHigh

Keychain credential access matters because macOS endpoints often hold passwords, private keys, certificates, secure notes, payment data, and application secrets in Apple’s built-in credential store. If an adversary can access Keychain data, a single compromised Mac can become an identity and secrets exposure problem rather than just an endpoint incident.

Executive priority

Prioritize this where macOS systems are used by administrators, developers, finance users, executives, or anyone handling certificates, cloud access, or sensitive application data. Leadership should ask whether macOS credential storage is covered by monitoring, whether password policy reduces the risk of unlocking stored credentials, and whether incident response playbooks treat Keychain access as potential credential compromise requiring identity review and evidence preservation.

Technical view

This is a macOS credential-access sub-technique under Credentials from Password Stores. Defenders should validate visibility into attempts to view or manipulate Keychains through Keychain Access, the built-in security command-line utility, and direct access to Keychain file locations such as ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/. ATT&CK provides no official detection text for this technique, but relationship context includes detection strategy DET0396, Detect Access to macOS Keychain for Credential Theft. ATT&CK also links this behavior to multiple macOS-capable malware/tools, making it useful for detection engineering and IR scoping when suspicious macOS credential activity is observed.

Likely telemetry

  • macOS process execution and command-line evidence for the security utility
  • Process ancestry for terminal, script, or application-driven Keychain access
  • File access or read activity involving ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/
  • Use of the Keychain Access application outside expected administrative or user patterns
  • Endpoint security alerts or audit events showing credential-store access on macOS

Detection direction

  • Confirm whether DET0396-style coverage is implemented for macOS Keychain access rather than assuming general endpoint monitoring is sufficient.
  • Tune for suspicious use of the security utility and unusual access to Keychain database locations, while accounting for legitimate administration and user password-management activity.
  • Correlate Keychain access with other credential-access or post-exploitation indicators, especially when observed from unexpected parent processes or scripts.
  • Treat direct Keychain file access as higher-risk when it occurs outside normal user or system workflows.
  • Because official ATT&CK detection text is not provided, validate detections against local macOS baselines and document known blind spots in process, file, and command-line collection.

Mitigation priorities

  • Apply the related ATT&CK mitigation M1027, Password Policies, with emphasis on strong passwords and prevention of password reuse.
  • Because the Login Keychain may use the current user’s login password by default, prioritize password strength for macOS accounts that have access to sensitive credentials or certificates.
  • Ensure incident response procedures include credential review and rotation decisions when Keychain access is suspected.
  • Inventory where macOS systems store high-value secrets such as private keys, certificates, application credentials, and secure notes so response teams can scope exposure quickly.
  • Use detection validation and audit evidence to show whether macOS credential-store access is monitored as part of compliance and security readiness.
Additional notes and limits

ATT&CK identifies this as a macOS-only credential-access sub-technique and provides concrete storage locations and access mechanisms. Relationship context shows use by several macOS-capable tools and malware families, and a revoked prior Keychain technique maps into this sub-technique. The strongest defensive value is validating macOS credential-store visibility and ensuring Keychain access changes IR from endpoint cleanup to identity and secret exposure assessment.

The supplied ATT&CK object does not include official detection guidance, and the mitigation relationship is limited to password policies. This take does not establish prevalence, active exploitation, customer exposure, or guaranteed detection coverage. Local macOS configuration, endpoint telemetry, user roles, and Keychain contents are required to determine actual risk and response scope.

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Official MITRE ATT&CK definition

Keychain

Adversaries may acquire credentials from Keychain. Keychain (or Keychain Services) is the macOS credential management system that stores account names, passwords, private keys, certificates, sensitive application data, payment data, and secure notes. There are three types of Keychains: Login Keychain, System Keychain, and Local Items (iCloud) Keychain. The default Keychain is the Login Keychain, which stores user passwords and information. The System Keychain stores items accessed by the operating system, such as items shared among users on a host. The Local Items (iCloud) Keychain is used for items synced with Apple’s iCloud service.

Keychains can be viewed and edited through the Keychain Access application or using the command-line utility security. Keychain files are located in ~/Library/Keychains/, /Library/Keychains/, and /Network/Library/Keychains/.[1][2][3]

Adversaries may gather user credentials from Keychain storage/memory. For example, the command security dump-keychain –d will dump all Login Keychain credentials from ~/Library/Keychains/login.keychain-db. Adversaries may also directly read Login Keychain credentials from the ~/Library/Keychains/login.keychain file. Both methods require a password, where the default password for the Login Keychain is the current user’s password to login to the macOS host.[4][5]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Related techniques

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

2 rows
DomainIDNameRelationship / procedure
EnterpriseT1142KeychainKeychain revoked by this object.
EnterpriseT1555Credentials from Password StoresThis object subtechnique of Credentials from Password Stores.
Associated objects

Groups, software, and campaigns

MalwareEnterprise

S1185: LightSpy

First observed in 2018, LightSpy is a modular malware family that initially targeted iOS devices in Southern Asia before expanding to Android and macOS platforms. It consists of a downloader, a main executable that manages network communications, and functionality-specific modules, typically implemented as `.dylib` files (iOS, macOS) or `.apk` files (Android). LightSpy can collect VoIP call recordings, SMS messages, and credential stores, which are then exfiltrated to a command and control (C2) server.[1]

AndroidWindowsiOS
MalwareEnterprise

S9010: GlassWorm

GlassWorm is a worm that propagated through supply chain attacks by compromising repository credentials from victim environments and having malicious payloads added to those compromised accounts for distribution to victims across the various development ecosystems.[1][2][3] GlassWorm has numerous variants, including Rust binaries, encrypted JavaScript and a variant leveraging invisible Unicode characters that made reverse engineering difficult.[4][1][5] GlassWorm has employed a unique command and control (C2) methodology using Solana blockchain.[6][1] GlassWorm was first reported in October 2025.[6][1][3]

macOSWindows
MalwareEnterprise

S0690: Green Lambert

Green Lambert is a modular backdoor that security researchers assess has been used by an advanced threat group referred to as Longhorn and The Lamberts. First reported in 2017, the Windows variant of Green Lambert may have been used as early as 2008; a macOS version was uploaded to a multiscanner service in September 2014.[1][2]

WindowsiOSmacOS
ToolEnterprise

S0363: Empire

Empire is an open-source, cross-platform remote administration and post-exploitation framework that is publicly available on GitHub. While the tool itself is primarily written in Python, the post-exploitation agents are written in pure PowerShell for Windows and Python for Linux/macOS. Empire was one of five tools singled out by a joint report on public hacking tools being widely used by adversaries.[1][2][3]

LinuxmacOSWindows
MalwareEnterprise

S1016: MacMa

MacMa is a macOS-based backdoor with a large set of functionalities to control and exfiltrate files from a compromised computer. MacMa has been observed in the wild since November 2021.[1] MacMa shares command and control and unique libraries with MgBot and Nightdoor, indicating a relationship with the Daggerfly threat actor.[2]

macOS
ToolEnterprise

S0349: LaZagne

LaZagne is a post-exploitation, open-source tool used to recover stored passwords on a system. It has modules for Windows, Linux, and OSX, but is mainly focused on Windows systems. LaZagne is publicly available on GitHub.[1]

LinuxmacOSWindows
MalwareEnterprise

S1153: Cuckoo Stealer

Cuckoo Stealer is a macOS malware with characteristics of spyware and an infostealer that has been in use since at least 2024. Cuckoo Stealer is a universal Mach-O binary that can run on Intel or ARM-based Macs and has been spread through trojanized versions of various potentially unwanted programs or PUP's such as converters, cleaners, and uninstallers.[1][2]

macOS
MalwareEnterprise

S1246: BeaverTail

BeaverTail is a malware that has both a JavaScript and C++ variant. Active since 2022, BeaverTail is capable of stealing logins from browsers and serves as a downloader for second stage payloads. BeaverTail has previously been leveraged by North Korea-affiliated actors identified as DeceptiveDevelopment or Contagious Interview. BeaverTail has been delivered to victims through code repository sites and has been embedded within malicious attachments.[1][2][3][4]

LinuxmacOSWindows
Relationship explorer

All related ATT&CK context

uses · GroupG1052: Contagious InterviewEnterprisedetects · Detection StrategyDET0396: Detect Access to macOS Keychain for Credential TheftEnterpriseuses · MalwareS1185: LightSpyEnterpriseuses · MalwareS9010: GlassWormEnterpriserevoked by · TechniqueT1142: KeychainEnterpriseuses · MalwareS0690: Green LambertEnterpriseuses · ToolS0363: EmpireEnterpriseuses · MalwareS0279: ProtonEnterpriseuses · MalwareS1016: MacMaEnterprisemitigates · MitigationM1027: Password PoliciesEnterpriseuses · ToolS0349: LaZagneEnterprisesubtechnique of · TechniqueT1555: Credentials from Password StoresEnterpriseuses · MalwareS0274: CalistoEnterpriseuses · MalwareS1153: Cuckoo StealerEnterpriseuses · MalwareS0278: iKittenEnterpriseuses · MalwareS1246: BeaverTailEnterprise
Mitigations

Mitigation direction

MitigationEnterprise

M1027: Password Policies

Set and enforce secure password policies for accounts to reduce the likelihood of unauthorized access. Strong password policies include enforcing password complexity, requiring regular password changes, and preventing password reuse. This mitigation can be implemented through the following measures:

Windows Systems:

- Use Group Policy Management Console (GPMC) to configure: - Minimum password length (e.g., 12+ characters). - Password complexity requirements. - Password history (e.g., disallow last 24 passwords). - Account lockout duration and thresholds.

Linux Systems:

- Configure Pluggable Authentication Modules (PAM): - Use `pam_pwquality` to enforce complexity and length requirements. - Implement `pam_tally2` or `pam_faillock` for account lockouts. - Use `pwunconv` to disable password reuse.

Password Managers:

- Enforce usage of enterprise password managers (e.g., Bitwarden, 1Password, LastPass) to generate and store strong passwords.

Password Blacklisting:

- Use tools like Have I Been Pwned password checks or NIST-based blacklist solutions to prevent users from setting compromised passwords.

Regular Auditing:

- Periodically audit password policies and account configurations to ensure compliance using tools like LAPS (Local Admin Password Solution) and vulnerability scanners.

*Tools for Implementation*

Windows:

- Group Policy Management Console (GPMC): Enforce password policies. - Microsoft Local Administrator Password Solution (LAPS): Enforce random, unique admin passwords.

Linux/macOS:

- PAM Modules (pam_pwquality, pam_tally2, pam_faillock): Enforce password rules. - Lynis: Audit password policies and system configurations.

Cross-Platform:

- Password Managers (Bitwarden, 1Password, KeePass): Manage and enforce strong passwords. - Have I Been Pwned API: Prevent the use of breached passwords. - NIST SP 800-63B compliant tools: Enforce password guidelines and blacklisting.

Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
1cd7b43705a8e623...
Imported snapshots across ATT&CK releases(1)
ReleaseBundle importedObject versionModifiedStatusRaw hash
19.11.1Current bundle1cd7b43705a8…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSONOpen MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    Keychain Services Apple

    Apple. (n.d.). Keychain Services. Retrieved April 11, 2022.

    Open source URL
  2. [2]
    Keychain Decryption Passware

    Yana Gourenko. (n.d.). A Deep Dive into Apple Keychain Decryption. Retrieved April 13, 2022.

    Open source URL
  3. [3]
    OSX Keychain Schaumann

    Jan Schaumann. (2015, November 5). Using the OS X Keychain to store and retrieve passwords. Retrieved March 31, 2022.

    Open source URL
  4. [4]
    External to DA, the OS X Way

    Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024.

    Open source URL
  5. [5]
    Empire Keychain Decrypt

    Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.

    Open source URL
  6. [6]
    Sekoia ClickFake 2025

    Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.

    Open source URL
  7. [7]
    Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

    Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.

    Open source URL
  8. [8]
    Socket HexEval BeaverTail Contagious Interview June 2025

    Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.

    Open source URL
  9. [9]
    Huntress LightSpy macOS 2024

    Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.

    Open source URL
  10. [10]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  11. [11]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  12. [12]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  13. [13]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  14. [14]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  15. [15]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  16. [16]
    GitHub LaZagne Dec 2018

    Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.

    Open source URL
  17. [17]
    Securelist Calisto July 2018

    Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.

    Open source URL
  18. [18]
    Symantec Calisto July 2018

    Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018.

    Open source URL
  19. [19]
    Kandji Cuckoo April 2024

    Kohler, A. and Lopez, C. (2024, April 30). Malware: Cuckoo Behaves Like Cross Between Infostealer and Spyware. Retrieved August 20, 2024.

    Open source URL
  20. [20]
    ESET Contagious Interview BeaverTail InvisibleFerret February 2025

    Matej Havranek. (2025, February 20). DeceptiveDevelopment targets freelance developers. Retrieved October 17, 2025.

    Open source URL
  21. [21]
    Empire Keychain Decrypt

    Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.

    Open source URL
  22. [22]
    Empire Keychain Decrypt

    Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.

    Open source URL
  23. [23]
    External to DA, the OS X Way

    Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024.

    Open source URL
  24. [24]
    External to DA, the OS X Way

    Alex Rymdeko-Harvey, Steve Borosh. (2016, May 14). External to DA, the OS X Way. Retrieved September 12, 2024.

    Open source URL
  25. [25]
    Keychain Decryption Passware

    Yana Gourenko. (n.d.). A Deep Dive into Apple Keychain Decryption. Retrieved April 13, 2022.

    Open source URL
  26. [26]
    Keychain Decryption Passware

    Yana Gourenko. (n.d.). A Deep Dive into Apple Keychain Decryption. Retrieved April 13, 2022.

    Open source URL
  27. [27]
    Keychain Services Apple

    Apple. (n.d.). Keychain Services. Retrieved April 11, 2022.

    Open source URL
  28. [28]
    Keychain Services Apple

    Apple. (n.d.). Keychain Services. Retrieved April 11, 2022.

    Open source URL
  29. [29]
    OSX Keychain Schaumann

    Jan Schaumann. (2015, November 5). Using the OS X Keychain to store and retrieve passwords. Retrieved March 31, 2022.

    Open source URL
  30. [30]
    OSX Keychain Schaumann

    Jan Schaumann. (2015, November 5). Using the OS X Keychain to store and retrieve passwords. Retrieved March 31, 2022.

    Open source URL
  31. [31]
    mitre-attackT1555.001
    Open source URL
  32. [32]
    mitre-attackT1555.001
    Open source URL
  33. [33]
    mitre-attackT1555.001
    Open source URL
  34. [34]
    Sekoia ClickFake 2025

    Amaury G., Coline Chavane, Felix Aimé and Sekoia TDR. (2025, March 31). From Contagious to ClickFake Interview: Lazarus leveraging the ClickFix tactic. Retrieved April 1, 2025.

    Open source URL
  35. [35]
    Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

    Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.

    Open source URL
  36. [36]
    Socket HexEval BeaverTail Contagious Interview June 2025

    Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.

    Open source URL
  37. [37]
    Huntress LightSpy macOS 2024

    Stuart Ashenbrenner, Alden Schmidt. (2024, April 25). LightSpy Malware Variant Targeting macOS. Retrieved January 3, 2025.

    Open source URL
  38. [38]
    Koi Glassworm New Tricks December 2025

    Gal Hachamov. (2025, December 29). GlassWorm Goes Mac: Fresh Infrastructure, New Tricks. Retrieved April 10, 2026.

    Open source URL
  39. [39]
    Socket GlassWorm January 2026

    Kirill Boychenko. (2026, January 31). GlassWorm Loader Hits Open VSX via Developer Account Compromise. Retrieved April 10, 2026.

    Open source URL
  40. [40]
    Glitch-Cat Green Lambert ATTCK Oct 2021

    Sandvik, Runa. (2021, October 18). Green Lambert and ATT&CK. Retrieved November 17, 2024.

    Open source URL
  41. [41]
    Objective See Green Lambert for OSX Oct 2021

    Sandvik, Runa. (2021, October 1). Made In America: Green Lambert for OS X. Retrieved March 21, 2022.

    Open source URL
  42. [42]
    Empire Keychain Decrypt

    Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.

    Open source URL
  43. [43]
    Empire Keychain Decrypt

    Empire. (2018, March 8). Empire keychaindump_decrypt Module. Retrieved April 14, 2022.

    Open source URL
  44. [44]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  45. [45]
    ESET DazzleSpy Jan 2022

    M.Léveillé, M., Cherepanov, A.. (2022, January 25). Watering hole deploys new macOS malware, DazzleSpy, in Asia. Retrieved May 6, 2022.

    Open source URL
  46. [46]
    GitHub LaZagne Dec 2018

    Zanni, A. (n.d.). The LaZagne Project !!!. Retrieved December 14, 2018.

    Open source URL
  47. [47]
    Securelist Calisto July 2018

    Kuzin, M., Zelensky S. (2018, July 20). Calisto Trojan for macOS. Retrieved September 7, 2018.

    Open source URL
  48. [48]
    Symantec Calisto July 2018

    Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018.

    Open source URL
  49. [49]
    objsee mac malware 2017

    Patrick Wardle. (n.d.). Mac Malware of 2017. Retrieved September 21, 2018.

    Open source URL
  50. [50]
    Socket BeaverTail XORIndex HexEval Contagious Interview July 2025

    Kirill Boychenko. (2025, July 14). Contagious Interview Campaign Escalates With 67 Malicious npm Packages and New Malware Loader. Retrieved October 19, 2025.

    Open source URL
  51. [51]
    Socket HexEval BeaverTail Contagious Interview June 2025

    Kirill Boychenko. (2025, June 25). Another Wave: North Korean Contagious Interview Campaign Drops 35 New Malicious npm Packages. Retrieved October 19, 2025.

    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK siteOfficial STIX data repositoryMITRE ATT&CK terms of use