Do you have any evidence to support this? macOS @ M1 boot process looks similar to that of iOS devices: https://support.apple.com/en-gb/guide/security/secac71d

Do you have any evidence to support this? macOS @ M1 boot process looks similar to that of iOS devices: https://support.apple.com/en-gb/guide/security/secac71d5623/web https://support.apple.com/en-gb/guide/security/secac71d5623/... Under the assumption that SIP is not disabled, and computer doesn't have any 3rd party kernel extensions installed (both of which are safe to assume for most people), it's close to impossible to inject something in the boot chain. --- I think the best possible option might be to replace the keyboard with the one with a hardware keylogger, and record the actual password.