AMOS Stealer Uses Fake macOS Toolkit Instructions to Target Credentials and Other Data
Summary
A lab analysis of an August 2026 AMOS stealer infection found fake macOS toolkit instructions led users to run scripts that installed the malware, which collected sensitive data and sent it to a changing C2 infrastructure.
Key points
- The infection began with a website offering fake macOS toolkit installation instructions that prompted users to paste commands into Terminal.
- The commands downloaded Zsh scripts and a Mach-O installer that deployed AMOS stealer on macOS.
- The malware created files in hidden Library/Application Support directories and required the user to enter an administrator password.
- AMOS requested permission to control Finder and Notes and access Desktop and Documents files.
- Collected data included browser credentials, cryptocurrency wallet data, cloud and developer-tool files, Telegram data, and shell history.
- The malware sent HTTP POST requests to a C2 server; the analyzed August 5 infection used a different server from a July 31 infection.
- Domains, IP addresses, filenames, hashes, and paths changed frequently, while overall infection and traffic patterns remained similar.
Article Details
- Attack Vectors
- A malicious website, getmacouscloud[.]com, instructed users to paste commands into macOS Terminal under the pretense of installing a macOS toolkit.
- The command downloaded a Zsh script that retrieved and ran a Mach-O installer for AMOS stealer.
- The infection requested the user's password and macOS permissions to control Finder and Notes and access Desktop and Documents files.
- The article also reports AMOS stealer distribution through ClickFix campaigns, malicious ads, and sites offering cracked software.
- Defensive Notes
- Palo Alto Networks states that Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
- The article notes that AMOS-associated domains, URLs, IP addresses, filenames, hashes, and directory paths change frequently; the listed indicators are a snapshot from early August 2026.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 161[.]35[.]146[.]120 | C2 server receiving HTTP POST traffic from the August 5, 2026 infection. |
| IPV4 | 188[.]166[.]78[.]138 | Different C2 server contacted by the July 31, 2026 AMOS infection. |
| SHA256 | 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 | Hash of another AMOS binary found persistent on the infected macOS host. |
| SHA256 | 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 | Hash of an AMOS binary found persistent on the infected macOS host. |
| SHA256 | 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c | Hash of the initial Zsh script downloaded during the AMOS infection. |
| SHA256 | 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a | Hash of the Zsh payload extracted from the initial script. |
| SHA256 | a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 | Hash of the AMOS stealer installer. |
| URL | hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update | URL returned by the malicious payload during the AMOS infection. |
| URL | hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 | Malicious URL serving the initial Zsh script. |
| URL | hxxps[:]//getmacouscloud[.]com | Malicious website with instructions that the article says infect a macOS host. |
| URL | hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted | URL returned by the malicious payload during the AMOS infection. |
MITRE ATT&CK
T1005 · Data from Local SystemAMOS collected system information, credentials, and other local data, including files associated with browsers, wallets, and other applications.T1027 · Obfuscated Files or InformationThe initial Zsh script contained Base64-encoded text for a GZIP-compressed payload.T1041 · Exfiltration Over C2 ChannelThe article reports post-infection HTTP POST traffic to C2 and describes AMOS as exfiltrating collected sensitive data.T1059.004 · Unix ShellThe infection used Zsh scripts and commands pasted into a macOS Terminal window.T1071.001 · Web ProtocolsThe infection used HTTP POST requests to communicate with its C2 server.T1105 · Ingress Tool TransferThe initial command and follow-up Zsh script retrieved scripts and a Mach-O AMOS installer.
Malware
Vendors
Products
Advanced DNS SecurityAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.Advanced URL FilteringAdvanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.macOSThis article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment.