On April 23, 2026, Field Effect MDR detected AMOS Stealer malware delivered via a new technique exploiting Cursor AI agent sessions running Claude Code. The attack leverages social engineering to manipulate operators into prompting the AI agent to execute malicious AppleScript loaders. These heavily obfuscated scripts evade sandbox detection, harvest sensitive information including credentials, SSH keys, browser data, and cryptocurrency wallets, and exfiltrate compressed archives to remote servers within two minutes. The malware also uses fake macOS system dialogs to obtain local account credentials, then uses elevated permissions to install persistent implants masquerading as legitimate system services. This novel delivery mechanism blends malicious commands with typical AI agent coding behavior, making detection challenging and representing an evolution in AMOS Stealer delivery tactics beyond traditional SEO poisoning methods. Indicators include multiple IP addresses, domains, URLs, and file hashes associated with the malware infrastructure. No known exploits in the wild or vendor patches are currently documented.

The malware harvests highly sensitive data including user credentials, SSH keys, browser data, and cryptocurrency wallets, enabling potential credential theft and financial loss. It achieves persistence on infected macOS systems by installing implants with elevated privileges disguised as legitimate services. The use of social engineering combined with AI agent exploitation complicates detection and response. The rapid exfiltration of compressed data within minutes increases the risk of significant data compromise before detection. This attack vector represents an advancement in AMOS Stealer tactics, increasing the threat to macOS users who interact with Cursor AI agent sessions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Given the lack of an official fix or vendor advisory, organizations should exercise caution when interacting with AI agent sessions, especially those running Claude Code or similar frameworks. Users should be trained to recognize social engineering attempts that prompt execution of scripts or commands. Monitoring for suspicious AppleScript execution and unusual network connections to the identified IPs and domains may help detect activity. Restricting the ability of AI agents to execute system-level scripts or commands can reduce risk. Incident response teams should leverage the provided indicators of compromise (IPs, domains, URLs, hashes) for detection and blocking. Stay updated with Field Effect and other vendor advisories for emerging patches or mitigations.