This malware campaign targets macOS systems by delivering an information stealer distinct from AMOS Stealer, using architecture-specific Mach-O binaries. The infection begins with a shell script loader downloaded from a malicious server, which saves a binary to the user's Library/Caches directory and ensures persistence via a LaunchAgents plist file. The malware requests permissions to access various user files, applications, and credentials, including the macOS Keychain. Post-infection, the malware communicates with a C2 server using HTTP POST requests and websocket traffic to exfiltrate stolen data. The binaries on disk show slight variations in size and hash, indicating multiple copies or versions. The campaign uses fake CAPTCHA/verification pages and clipboard-injected text to trick users into executing the loader.

The malware steals sensitive information from infected macOS hosts, including files, application data, and credentials stored in the macOS Keychain. It achieves persistence on the system and maintains ongoing communication with a C2 server to exfiltrate data. The campaign's use of social engineering (fake CAPTCHA pages and clipboard injection) increases the likelihood of user infection. There is no indication of ransomware or destructive payloads, but the information theft poses a significant privacy and security risk to affected users.

No official patch or fix is indicated in the provided information. Mitigation should focus on user awareness to avoid executing suspicious scripts or commands, especially those received via clipboard injection or from untrusted domains. Monitoring for persistence mechanisms such as suspicious LaunchAgents plist files and unexpected binaries in user Library/Caches directories can aid detection. Blocking known malicious domains and IP addresses associated with the campaign can reduce exposure. Since the malware requests extensive permissions, users should be cautious about granting access prompts. No vendor advisory or official remediation guidance is available; therefore, users should follow best practices for macOS security and incident response.