# T1555.001 Keychain

> As of 2026-10-05, T1555.001 (Keychain) appears in 45 tracked threats, first reported 2026-02-24 and most recently 2026-10-02, with linked actors including APT38, ClickLock Dev, Sapphire Sleet; it most often appears alongside T1005 (Data from Local System).

- **Tracked threats:** 45 (5 critical, 38 high, 2 medium)
- **First seen:** 2026-02-24
- **Last seen:** 2026-10-02
- **Threat actors:** 13
- **Detection rules:** 100 (counts only; Blue tier and above)

## Key facts

- **ID:** T1555.001
- **Framework:** MITRE ATT&CK
- **Tactics:** Credential Access
- **Matrix:** Enterprise
- **Parent:** T1555
- **Data as of:** 2026-10-05
- **MITRE:** https://attack.mitre.org/techniques/T1555/001/

## Activity timeline

T1555.001 first appeared in tracked threats on 2026-02-24 and was most recently reported on 2026-10-02. The busiest month was 2026-07 with 14 reports, and 45 of the 45 threats were reported in the twelve months to 2026-10.

## How adversaries use it

T1555.001 Keychain is catalogued by MITRE ATT&CK under the Credential Access tactic in the Enterprise matrix, as a sub-technique of [T1555 Credentials from Password Stores](https://intel.threadlinqs.com/technique/T1555). Threadlinqs maps 45 of 2623 tracked threats (1.7%) to it; by severity that is 5 critical, 38 high, 2 medium.

Threats that use T1555.001 most often also use [T1005 Data from Local System](https://intel.threadlinqs.com/technique/T1005) (40 threats), [T1555.003 Credentials from Web Browsers](https://intel.threadlinqs.com/technique/T1555.003) (37 threats), [T1059.004 Unix Shell](https://intel.threadlinqs.com/technique/T1059.004) (36 threats), [T1082 System Information Discovery](https://intel.threadlinqs.com/technique/T1082) (36 threats), [T1071.001 Web Protocols](https://intel.threadlinqs.com/technique/T1071.001) (34 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

13 tracked threat actors appear in the threats that use T1555.001; the most frequent are [APT38](https://intel.threadlinqs.com/actor/APT38) (3), [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) (2), [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) (2), [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) (2), [AMOS Operators](https://intel.threadlinqs.com/actor/AMOS%20Operators) (1).

## Mitigations

MITRE ATT&CK lists 1 mitigation for T1555.001.

- [M1027 Password Policies](https://attack.mitre.org/mitigations/M1027/)

## Data sources

Telemetry that can reveal T1555.001, per MITRE ATT&CK.

- Command — Command Execution
- File — File Access
- Process — OS API Execution, Process Creation

## Threat actors using it

- [APT38](https://intel.threadlinqs.com/actor/APT38) — 3
- [ClickLock Dev](https://intel.threadlinqs.com/actor/ClickLock%20Dev) — 2
- [Sapphire Sleet](https://intel.threadlinqs.com/actor/Sapphire%20Sleet) — 2
- [Stardust Chollima](https://intel.threadlinqs.com/actor/Stardust%20Chollima) — 2
- [AMOS Operators](https://intel.threadlinqs.com/actor/AMOS%20Operators) — 1
- [Andariel](https://intel.threadlinqs.com/actor/Andariel) — 1
- [Contagious Interview](https://intel.threadlinqs.com/actor/Contagious%20Interview) — 1
- [DriveSurge](https://intel.threadlinqs.com/actor/DriveSurge) — 1
- [Jade Sleet](https://intel.threadlinqs.com/actor/Jade%20Sleet) — 1
- [Lazarus Group](https://intel.threadlinqs.com/actor/Lazarus%20Group) — 1
- [UNC5342](https://intel.threadlinqs.com/actor/UNC5342) — 1
- [UNC6353](https://intel.threadlinqs.com/actor/UNC6353) — 1

## Tracked threats

The 30 most recent of 45 tracked threats that use T1555.001.

- [Atomic macOS (AMOS) Stealer Delivered via Malicious Ad Impersonating Claude Code (ClickFix-style)](https://intel.threadlinqs.com/threat/TL-2026-2916) — high — 2026-10-02
- [MacSync (Mac.c) macOS Info-Stealer Abuses Public iCloud Calendars as C2 Dead-Drop in Fake "Toria" Crypto…](https://intel.threadlinqs.com/threat/TL-2026-2723) — high — 2026-09-27
- [PamStealer macOS Infostealer Adds Live C2 with X25519 Key Exchange, Four-Method Persistence](https://intel.threadlinqs.com/threat/TL-2026-2674) — high — 2026-09-26
- [MacSync macOS infostealer abuses public iCloud calendars as a command channel to deliver a new backdoor module](https://intel.threadlinqs.com/threat/TL-2026-2641) — high — 2026-09-24
- [MacSync macOS infostealer/backdoor: reworked MaaS chain stages stage-two via a public iCloud calendar…](https://intel.threadlinqs.com/threat/TL-2026-2637) — high — 2026-09-24
- [Macfinger ClickFix Campaign Delivers Atomic macOS Stealer (AMOS) via Fake Verification Prompts](https://intel.threadlinqs.com/threat/TL-2026-2622) — high — 2026-09-23
- [Trusted AI Platforms Weaponized as Malware Distribution Channels: Claude Artifacts, ChatGPT, and Grok Abused…](https://intel.threadlinqs.com/threat/TL-2026-2604) — high — 2026-09-21
- [Jade Sleet (North Korea) Compromises Indian IT Provider via FLATROOF and ROOFDECK macOS Backdoors](https://intel.threadlinqs.com/threat/TL-2026-2599) — high — 2026-09-21
- [Apple Ships 273-CVE Coordinated Security Update Across iOS 27, macOS, watchOS, tvOS, visionOS, Safari, and…](https://intel.threadlinqs.com/threat/TL-2026-2522) — critical — 2026-09-15
- [Threat Actors Abuse Trusted AI Platforms (Claude, ChatGPT, Grok) to Distribute Malware](https://intel.threadlinqs.com/threat/TL-2026-2197) — high — 2026-08-29
- [Post-DEF CON Phishing Campaign Abuses Google Apps Script Sidebar to Deliver AMOS Stealer and NetSupport RAT](https://intel.threadlinqs.com/threat/TL-2026-2449) — high — 2026-08-19
- [Go-Based macOS Stealer Uses ClickFix Lures to Drain Cryptocurrency Wallets (Aeza Group Infrastructure)](https://intel.threadlinqs.com/threat/TL-2026-2066) — high — 2026-08-18
- [Apple Patches ImageIO Integer Overflow (CVE-2026-65346) Exploitable via Malicious Images](https://intel.threadlinqs.com/threat/TL-2026-2060) — high — 2026-08-18
- [AmnesiaStealer: macOS Infostealer Hijacks Live Browser Sessions via Chrome DevTools Protocol Remote Control](https://intel.threadlinqs.com/threat/TL-2026-2029) — high — 2026-08-16
- [ClickFix Attacks Deliver Go-Based macOS Infostealer Targeting Crypto Wallets and Keychain Data](https://intel.threadlinqs.com/threat/TL-2026-1936) — high — 2026-08-07
- [ClickFix Attack Delivers Go-Based macOS Infostealer Targeting Cryptocurrency Wallets and Credentials](https://intel.threadlinqs.com/threat/TL-2026-1920) — high — 2026-08-06
- [Over 250 Fake Download Domains Deliver AMOS and MacSync Infostealers via ClickFix with Server-Side Browser…](https://intel.threadlinqs.com/threat/TL-2026-1907) — high — 2026-08-06
- [Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures — Atomic Stealer (AMOS) and…](https://intel.threadlinqs.com/threat/TL-2026-1899) — high — 2026-08-05
- [macOS ClickFix Campaign Using Browser Fingerprinting Gate to Distribute Atomic Stealer (AMOS) and MacSync…](https://intel.threadlinqs.com/threat/TL-2026-1894) — high — 2026-08-05
- [Atomic MacOS (AMOS) Stealer Infection via Fake "macOS Toolkit" Terminal Command](https://intel.threadlinqs.com/threat/TL-2026-1813) — medium — 2026-08-02
- [BlueNoroff Fake Meeting Kit Captures Webcams, Disables Windows Defender, and Steals Cryptocurrency…](https://intel.threadlinqs.com/threat/TL-2026-1719) — high — 2026-07-27
- [ClickFix, CrashFix, InstallFix, FileFix & GhostClaw: Growing Family of Copy-and-Paste Social Engineering…](https://intel.threadlinqs.com/threat/TL-2026-1551) — high — 2026-07-19
- [SHub Stealer "Reaper" — macOS Infostealer Using applescript:// URL-Scheme Delivery, Filegrabber Module, and…](https://intel.threadlinqs.com/threat/TL-2026-1475) — high — 2026-07-18
- [CrashStealer: Novel macOS Information Stealer Disguised as Apple Crash Reporter (Jamf Threat Labs)](https://intel.threadlinqs.com/threat/TL-2026-1470) — medium — 2026-07-18
- [ClickLock Stealer: macOS ClickFix Infostealer Uses 210ms Process-Kill Loops and Fake Authentication Dialogs…](https://intel.threadlinqs.com/threat/TL-2026-1440) — high — 2026-07-17
- [macOS Infostealer Hijacks Telegram Desktop Sessions via tdata Theft to Bypass 2FA, Harvests Keychain…](https://intel.threadlinqs.com/threat/TL-2026-1424) — high — 2026-07-16
- [ClickLock Stealer: ClickFix-Delivered macOS Infostealer with GSocket Reverse-Shell Backdoor](https://intel.threadlinqs.com/threat/TL-2026-1402) — high — 2026-07-16
- [MacSync Stealer: 'ClaudeFix' Malvertising Campaign Abuses Shared Claude Chat Links to Deploy macOS Infostealer](https://intel.threadlinqs.com/threat/TL-2026-1384) — high — 2026-07-15
- [AsyncAPI npm Supply Chain Attack: Pwn-Request GitHub Actions Compromise Deploys Miasma Tasking Framework](https://intel.threadlinqs.com/threat/TL-2026-1360) — critical — 2026-07-15
- [CrashStealer: Notarized Fake Apple CrashReporter App Steals macOS Keychain, Browser, and Crypto Wallet…](https://intel.threadlinqs.com/threat/TL-2026-1358) — high — 2026-07-15

## Related CVEs

CVEs referenced by the tracked threats that use T1555.001, most frequent first.

- [CVE-2025-14174](https://intel.threadlinqs.com/cve/CVE-2025-14174)
- [CVE-2025-31277](https://intel.threadlinqs.com/cve/CVE-2025-31277)
- [CVE-2025-43510](https://intel.threadlinqs.com/cve/CVE-2025-43510)
- [CVE-2025-43520](https://intel.threadlinqs.com/cve/CVE-2025-43520)
- [CVE-2025-43529](https://intel.threadlinqs.com/cve/CVE-2025-43529)
- [CVE-2026-20700](https://intel.threadlinqs.com/cve/CVE-2026-20700)
- [CVE-2026-43760](https://intel.threadlinqs.com/cve/CVE-2026-43760)
- [CVE-2026-65400](https://intel.threadlinqs.com/cve/CVE-2026-65400)
- [CVE-2026-65414](https://intel.threadlinqs.com/cve/CVE-2026-65414)

## Detection coverage

Threadlinqs maintains 100 detection rules mapped to T1555.001 (SPL 34, KQL 40, Sigma 26). Rule content is available to Blue tier accounts and above; this page shows counts only.

100 detection rules (SPL/KQL/Sigma), Blue and above: https://threadlinqs.com/pricing

## Parent technique

[T1555 Credentials from Password Stores](https://intel.threadlinqs.com/technique/T1555) — 445 tracked threats at the technique level.

## Links

- Canonical page: https://intel.threadlinqs.com/technique/T1555.001
- All techniques: https://intel.threadlinqs.com/techniques
- Full detection coverage and IOCs: https://intel.threadlinqs.com/mcp (Purple tier)