Atomic MacOS (AMOS) stealer infection

1. Executive summary

On 2026-07-31, a lab infection of the Atomic MacOS (AMOS) stealer was generated and analysed by SANS ISC, distributed via a fake "macOS toolkit" website (getmacouscloud[.]com). The infection chain relies on social engineering users into pasting a zsh command into Terminal, which downloads and installs a Mach-O universal binary stealer. AMOS exfiltrates credentials, browser data, messenger data, and cryptocurrency wallets via HTTP POST to a hardcoded C2 IP. EMEA financial services firms with macOS endpoints — particularly those allowing unmanaged or BYOD Macs used for corporate authentication — face direct risk of session-token and credential theft enabling account takeover.

2. Regulatory framing

No specific DORA/NIS2 article is directly engaged by this item. While credential theft on an endpoint could become an ICT-related incident, the lab-generated nature of this report means no incident has occurred in a client environment. The IOCs and detection guidance are threat-intelligence inputs to general security posture rather than triggers for a specific regulatory obligation.

3. Technical analysis & attack chain

Confidence caveat: This analysis is single-sourced, derived entirely from a SANS ISC lab infection conducted by Bradley Duncan on 2026-07-31. The IOCs reflect one controlled execution; production infections may vary. Attribution to the AMOS stealer "family" is based on the author's identification and C2 API structure; no MITRE ATT&CK actor profile is available for this item, and no named threat actor is confirmed.

Attack chain (confirmed from lab traffic)

1. Initial access (social engineering): User visits getmacouscloud[.]com (reached via macostruecloud[.]xyz and macspheres[.]com). The page instructs the user to copy and paste text into a macOS Terminal window, framed as a "macOS toolkit."
2. Stage 1 script retrieval: The pasted text is a zsh command that fetches a 1,973-byte zsh script from hxxps[:]//render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9 (SHA-256: b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c).
3. Stage 2 script extraction: The first script contains base64 text that, when decoded and decompressed (gzip), yields a second 1,227-byte zsh script (SHA-256: 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5). This script retrieves the primary payload and reports execution via hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted and hxxps[:]//render65[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update.
4. Payload deployment: A 297,952-byte Mach-O universal binary (x86_64 & arm64) is written to /tmp/helper (SHA-256: 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab). The user is prompted for their macOS account password, enabling the stealer to access Keychain and protected data.
5. Persistence: Two Mach-O universal binaries are installed in the user's Library: - /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper (438,656 bytes; SHA-256: 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836) - /Users/[username]/Library/Application Support/.com.apple.metadata.mds/mdworker_shared (503,152 bytes; SHA-256: 01a0d5332b09bb299f7784bf0d0c43c4199269ed6a0712377279eeb999847d20) Both use dot-prefixed directory names mimicking legitimate Apple system paths.
6. C2 communication & data exfiltration: The stealer communicates with 188.166.78[.]138 over TCP port 80 (cleartext HTTP). The C2 API uses a structured staging model, with HTTP POST requests to /api/metrics/run?event=stage&stage= for each data category: init_session, messengers, credentials, browsers, wallets, resolve_auth, and local_data. Additional C2 endpoints include /api/join/, /api/bots/device-info, /api/tasks/ack, /api/feed/register, and /contact. HTTP GET requests are used for task retrieval (/api/tasks/ and /api/feed/items/).

Key technical specifics

• Cleartext C2: All C2 traffic uses HTTP over port 80 — not HTTPS — making network-level detection straightforward if egress filtering or TLS-inspection proxies are in place.
• Universal binary: The Mach-O payloads target both Intel (x86_64) and Apple Silicon (arm64) architectures.
• Stolen data staging: Files are temporarily staged in /tmp before exfiltration.

4. Mitigation & containment

P1 — Within 24 hours

• Block the following domains and IP at the network perimeter, proxy, and EDR firewall rules:
• getmacouscloud[.]com, macostruecloud[.]xyz, macspheres[.]com, render65[.]com, grove-89[.]com
• IP: 188.166.78[.]138 (all ports, prioritising TCP 80)
• Add SHA-256 hashes for all five identified files to EDR blocklists and quarantine rules.
• Hunt for persistence paths across macOS fleet:
• ~/Library/Application Support/.com.apple.accountsd/AccountsHelper
• ~/Library/Application Support/.com.apple.metadata.mds/mdworker_shared
• /tmp/helper
• Review proxy/DNS logs for the identified C2 API URI patterns (/api/metrics/run?event=, /api/join/, /api/bots/device-info, /api/feed/register) dating back to 2026-07-31.

P2 — Within 72 hours

• Deploy EDR detection rules (see §6) for the identified file paths, C2 URI patterns, and binary names.
• If an infection is confirmed on any endpoint: isolate the host, force password resets for all credentials stored in macOS Keychain, revoke active browser session tokens/cookies, and rotate credentials for any accessed cryptocurrency wallets or messenger applications.
• Review authentication logs for anomalous sessions or account takeovers originating from affected hosts.

P3 — Within 7 days

• Update user security awareness training to specifically address the "paste this into Terminal" social engineering vector.
• Restrict execution of unsigned binaries from /tmp and ~/Library/Application Support/ using macOS Gatekeeper / MDM configuration profiles where feasible.
• Evaluate blocking outbound TCP port 80 traffic from macOS endpoints where HTTPS is the expected protocol.

5. Indicators of compromise

domain  getmacouscloud[.]com
domain  macostruecloud[.]xyz
domain  macspheres[.]com
domain  render65[.]com
domain  grove-89[.]com
ipv4  188.166.78[.]138
url  hxxps[:]//macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304
url  hxxps[:]//getmacouscloud[.]com/?FSSbmnNdviEDE5S?io=16vwsb0rgIiPNIgM
url  hxxps[:]//render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9
url  hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted
url  hxxps[:]//render65[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=started&stage=boot
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=init_session
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=messengers
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=credentials
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=browsers
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=wallets
url  hxxp[:]//188.166.78[.]138/contact
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=resolve_auth
url  hxxp[:]//188.166.78[.]138/api/metrics/run?event=stage&stage=local_data
url  hxxp[:]//188.166.78[.]138/api/join/
url  hxxp[:]//188.166.78[.]138/api/bots/device-info
url  hxxp[:]//188.166.78[.]138/api/tasks/ack
url  hxxp[:]//188.166.78[.]138/api/feed/register
url  hxxp[:]//188.166.78[.]138/api/tasks/r3dqbX7fptIT-gXz--D_nw?v=2.1
url  hxxp[:]//188.166.78[.]138/api/feed/items/49359f77ebb4ffd9a95568d27a8ff3e7
sha256  b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c
sha256  13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5
sha256  9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab
sha256  0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836
sha256  01a0d5332b09bb299f7784bf0d0c43c4199269ed6a0712377279eeb999847d20
filepath  /tmp/helper
filepath  /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper
filepath  /Users/[username]/Library/Application Support/.com.apple.metadata.mds/mdworker_shared

6. Detection

rule AMOS_Stealer_Lab_2026_07 {
  meta:
    author = "Adverse Trace"
    date = "2026-08-02"
    reference = "https://isc.sans.edu/diary/rss/33208"
    description = "Detects AMOS stealer persistence paths and C2 API URI patterns"
  strings:
    $path1 = "/Library/Application Support/.com.apple.accountsd/AccountsHelper" ascii
    $path2 = "/Library/Application Support/.com.apple.metadata.mds/mdworker_shared" ascii
    $path3 = "/tmp/helper" ascii
    $api1 = "/api/metrics/run?event=stage&stage=credentials" ascii
    $api2 = "/api/metrics/run?event=stage&stage=wallets" ascii
    $api3 = "/api/metrics/run?event=stage&stage=browsers" ascii
    $api4 = "/api/metrics/run?event=stage&stage=messengers" ascii
    $api5 = "/api/bots/device-info" ascii
    $api6 = "/api/feed/register" ascii
    $api7 = "/api/join/" ascii
  condition:
    3 of them
}

title: Atomic MacOS AMOS Stealer C2 Communication
id: 7a3c1f2e-4b5d-4a8e-9c1f-2d3e4f5a6b7c
status: experimental
description: Detects HTTP traffic to AMOS stealer C2 server on port 80 with known API paths
author: Adverse Trace
date: 2026/08/02
references:

  - https://isc.sans.edu/diary/rss/33208
logsource:
  category: network_connection
  product: zeek
detection:
  selection_c2_ip:
    destination.ip: "188.166.78.138"
    destination.port: 80
  selection_c2_uri:
    c-uri|contains:

      - "/api/metrics/run?event="
      - "/api/join/"
      - "/api/bots/device-info"
      - "/api/tasks/ack"
      - "/api/feed/register"
      - "/api/feed/items/"
  condition: selection_c2_ip and selection_c2_uri
falsepositives:

  - Unlikely; the combination of IP and URI pattern is highly specific
level: high

title: Atomic MacOS AMOS Stealer Persistence Files
id: 8b4d2g3f-5c6e-4b9f-0d2g-3e4f5a6b7c8d
status: experimental
description: Detects AMOS stealer persistence binaries in macOS Library paths
author: Adverse Trace
date: 2026/08/02
references:

  - https://isc.sans.edu/diary/rss/33208
logsource:
  category: file_event
  product: macos
detection:
  selection_persistence:
    TargetFilename|endswith:

      - "/Library/Application Support/.com.apple.accountsd/AccountsHelper"
      - "/Library/Application Support/.com.apple.metadata.mds/mdworker_shared"
  selection_tmp:
    TargetFilename: "/tmp/helper"
  condition: selection_persistence or selection_tmp
falsepositives:

  - None expected; dot-prefixed Apple-impersonating paths are not legitimate
level: critical

7. Sources

• SANS Internet Storm Center — Bradley Duncan, "Atomic MacOS (AMOS) stealer infection," https://isc.sans.edu/diary/rss/33208, 2026-08-02
• Help Net Security — "New macOS malware steals passwords by posing as Apple's crash-reporting tool," https://www.helpnetsecurity.com/2026/07/14/crashstealer-macos-infostealer-password-theft/, 2026-07-14 (context only; describes a separate but related macOS stealer trend)

8. Adverse Trace position

AMOS remains an active and capable macOS stealer targeting exactly the data categories — credentials, browser sessions, and cryptocurrency wallets — that present the highest fraud and account-takeover risk to financial services clients. The cleartext HTTP C2 channel on port 80 is a detection advantage. This advisory is single-sourced from a lab infection; clients should treat the IOCs as valid but non-exhaustive — production AMOS campaigns will rotate infrastructure and may alter payload delivery paths. We assess the immediate risk to EMEA financial services as moderate: macOS is a minority endpoint OS in most firms but is disproportionately used by senior staff and developers whose credentials carry elevated access. We will update this advisory if corroborated wild infections or additional infrastructure are reported.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.