2745
If the user enters their password and clicks OK , the software grabs the info , and then it tries to open a remote connection to : MacDownloader collects user keychain information and uploads it to said C&C server , including documents the running processes , installed applications and the username and password , which are acquired through a fake System Preferences dialog .
 ( data breach: collects,  MacDownloader: tool, user keychain information: compromised data, acquired through a fake System Preferences dialog: attack pattern) 
Locate the role in the text that participated in the event based on the event type and return it in the event list. 
 Option: Event type: phishing, data breach, ransom, discover vulnerability, patch vulnerability, Arguments type: vulnerable system, capabilities, vulnerability, number of victim, issues addressed, compromised data, damage amount, common vulnerabilities and exposures, victim, patch number, number of data, tool, discoverer, time, purpose, place, payment method, releaser, vulnerable system version, attacker, supported platform, patch, price, vulnerable system owner, trusted entity, attack pattern. 
Text: {0} 
Answer:
 ( data breach: collects,  MacDownloader: tool, user keychain information: compromised data, acquired through a fake System Preferences dialog: attack pattern) 