/
← Voltar ao feed
medium cryptocurrency general consumers

Atomic macOS Stealer (AMOS) infection chain analyzed from fake macOS toolkit install page, August 2026

1 fonte(s) · 1 atualização(ões) · publicado 16/09/2026 07:00 · coletado há 1 dia

Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud[.]com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS payload. AMOS has been advertised on Telegram since at least April 2024 and steals system information, credentials, browser data and cryptocurrency wallet data. It is also distributed via ClickFix campaigns, malicious ads and cracked-software lures. Unit 42 compared this infection with one from July 31, 2026, and found similar behavior but different C2 infrastructure. It concludes that AMOS is under active development and its indicators change frequently.

Technical Details

  • The pasted Terminal command retrieves a Zsh script from hxxps[:]//ferncore13[.]com/curl/608e70d1...bd688. The script holds Base64-encoded, GZIP-compressed text that unpacks into a second Zsh script.
  • The second script fetches and runs a Mach-O universal binary (x86_64 and ARM64) saved as /tmp/helper. A plist named /tmp/starter is dropped alongside it.
  • Persistence and payload files sit in hidden directories: ~/Library/Application Support/.com.apple.accountsd/ (.service shell script, AccountsHelper Mach-O) and ~/Library/Application Support/.com.apple.metadata.mds/ (.mdworker script, mdworker_shared Mach-O). The names mimic legitimate Apple components.
  • The infection prompts for the user's password (the lab account was an administrator). Terminal then requests access to Finder, Desktop, Documents and Notes.
  • Data is staged in /tmp and compressed into out.zip. Its contents include deskwallets/Binance, deskwallets/TonKeeper, FileGrabber/aws, docker, filezilla, gcloud, zsh_history and Telegram Data.
  • Post-infection traffic is mostly HTTP POST to the C2 at 161.35.146[.]120. The July 31 infection used 188.166.78[.]138.
  • Other URLs extracted from the payload: hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted and hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update.
  • SHA-256 hashes: initial Zsh script 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c; extracted Zsh payload 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a; installer a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9; AccountsHelper 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620; mdworker_shared 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9.

Remediation

  • Block the domains, URLs and IPs listed above. Because AMOS indicators change frequently, pair this with behavioral detection.
  • Train users not to paste commands from web pages into Terminal, and warn about malicious ads and cracked-software lures.
  • Hunt for hidden directories and files named .com.apple.accountsd and .com.apple.metadata.mds in user Library paths, and for /tmp/helper and /tmp/out.zip.
  • Palo Alto Networks Advanced URL Filtering and Advanced DNS Security flag the known domains and URLs as malicious.

Linha do tempo

  1. unit42.paloaltonetworks.com ↗ · pub. 16/09/2026 07:00 · coletado 19/10 17:56 primeiro registro

    Atomic macOS Stealer (AMOS) infection chain analyzed from fake macOS toolkit install page, August 2026

    ler a análise desta fonte

    Unit 42 analyzed an Atomic macOS (AMOS) stealer infection generated in a lab on Aug. 5, 2026, starting from a fake "macOS toolkit" instruction page hosted at getmacouscloud[.]com. The page tells victims to paste a command into Terminal, a ClickFix-style copy/paste technique, which downloads a Zsh script and then installs a Mach-O AMOS payload. AMOS has been advertised on Telegram since at least April 2024 and steals system information, credentials, browser data and cryptocurrency wallet data. It is also distributed via ClickFix campaigns, malicious ads and cracked-software lures. Unit 42 compared this infection with one from July 31, 2026, and found similar behavior but different C2 infrastructure. It concludes that AMOS is under active development and its indicators change frequently.

    Technical Details

    • The pasted Terminal command retrieves a Zsh script from hxxps[:]//ferncore13[.]com/curl/608e70d1...bd688. The script holds Base64-encoded, GZIP-compressed text that unpacks into a second Zsh script.
    • The second script fetches and runs a Mach-O universal binary (x86_64 and ARM64) saved as /tmp/helper. A plist named /tmp/starter is dropped alongside it.
    • Persistence and payload files sit in hidden directories: ~/Library/Application Support/.com.apple.accountsd/ (.service shell script, AccountsHelper Mach-O) and ~/Library/Application Support/.com.apple.metadata.mds/ (.mdworker script, mdworker_shared Mach-O). The names mimic legitimate Apple components.
    • The infection prompts for the user's password (the lab account was an administrator). Terminal then requests access to Finder, Desktop, Documents and Notes.
    • Data is staged in /tmp and compressed into out.zip. Its contents include deskwallets/Binance, deskwallets/TonKeeper, FileGrabber/aws, docker, filezilla, gcloud, zsh_history and Telegram Data.
    • Post-infection traffic is mostly HTTP POST to the C2 at 161.35.146[.]120. The July 31 infection used 188.166.78[.]138.
    • Other URLs extracted from the payload: hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted and hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update.
    • SHA-256 hashes: initial Zsh script 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c; extracted Zsh payload 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a; installer a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9; AccountsHelper 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620; mdworker_shared 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9.

    Remediation

    • Block the domains, URLs and IPs listed above. Because AMOS indicators change frequently, pair this with behavioral detection.
    • Train users not to paste commands from web pages into Terminal, and warn about malicious ads and cracked-software lures.
    • Hunt for hidden directories and files named .com.apple.accountsd and .com.apple.metadata.mds in user Library paths, and for /tmp/helper and /tmp/out.zip.
    • Palo Alto Networks Advanced URL Filtering and Advanced DNS Security flag the known domains and URLs as malicious.