Atomic macOS (AMOS) Stealer Activity
ID: 728fc20d-3e90-5202-8954-7863091e259a
STIX ID: report--728fc20d-3e90-5202-8954-7863091e259a
Feed Name: Palo Alto Networks Unit 42
Threat Score
This report analyzes an AMOS macOS infostealer infection (lab reproduction, Aug 5, 2026), describing a copy/paste Zsh-based infection vector from a malicious site, retrieved Mach-O binaries and plist persistence, permission prompts and credential escalation, data collection (browsers, wallets, credentials), post-infection POST traffic to C2 servers, and a set of IOCs (file hashes, URLs, domains, IPs) to aid detection and mitigation.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.