CampaignPublished 4 Jun 2025

AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers

Source AlienVault OTX General

Description

A sophisticated campaign using typo-squatted 'Spectrum' domains has been uncovered, spreading a new Atomic macOS Stealer (AMOS) variant. The attack, disguised as a CAPTCHA verification, employs dynamic payloads based on the victim's operating system. For macOS users, a malicious shell script steals system passwords and downloads an AMOS variant. The script uses native macOS commands to harvest credentials, bypass security, and execute malicious binaries. Russian-language comments in the source code suggest involvement of Russian-speaking cybercriminals. The campaign's delivery sites show flawed logic, indicating hasty assembly. This multi-platform social engineering attack targets both consumer and corporate users, highlighting an increasing trend in cross-platform threats.

Impact

For European organizations, this campaign poses a significant risk, especially to macOS users within corporate and consumer environments. The theft of system passwords and credentials can lead to unauthorized access to sensitive systems, data breaches, and lateral movement within networks. Given the campaign’s use of social engineering and dynamic payloads, even well-defended environments may be vulnerable if users are deceived into executing malicious scripts. Credential compromise can facilitate further attacks such as ransomware deployment, espionage, or data exfiltration. The multi-platform nature means that while macOS users are primarily targeted, other operating systems may also be affected, broadening the potential impact. The use of typo-squatted domains increases phishing risks and brand impersonation, undermining trust in legitimate Spectrum-branded services. Organizations with remote or hybrid workforces using macOS devices face elevated risks of credential theft and subsequent compromise. Additionally, the involvement of Russian-speaking actors may raise geopolitical concerns, particularly for sectors critical to national infrastructure or sensitive industries in Europe.

Defensive guidance

1. Implement strict domain filtering and DNS monitoring to detect and block access to known typo-squatted domains such as applemacios.com, spectrum-ticket.net, panel-spectrum.net, and others identified in the campaign. 2. Deploy advanced endpoint detection and response (EDR) solutions on macOS devices capable of detecting suspicious shell script executions and anomalous use of native macOS commands related to credential harvesting. 3. Educate users on social engineering risks, emphasizing caution around unexpected CAPTCHA prompts or unsolicited verification requests, and conduct targeted phishing simulations reflecting this campaign’s tactics. 4. Enforce multi-factor authentication (MFA) across all systems to mitigate the impact of credential theft. 5. Regularly audit and monitor authentication logs and credential usage for signs of compromise or lateral movement within networks. 6. Apply least privilege principles to limit script execution capabilities and access to sensitive data on macOS endpoints. 7. Use application whitelisting on macOS devices to prevent unauthorized or unknown script execution. 8. Maintain up-to-date threat intelligence feeds to quickly identify and respond to emerging indicators related to this campaign. 9. For organizations with macOS fleets, deploy specialized macOS security tools designed to detect and block stealer malware behaviors. 10. Establish incident response plans that include rapid containment and remediation steps for credential theft incidents.

Indicators of compromise

Domains 4

applemacios.com
panel-spectrum.net
rugmel.cat
spectrum-ticket.net

Hashes 1

eaedee8fc9fe336bcde021bf243e332a

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 6 Jul 2025, 21:42 UTC

MITRE ATT&CK techniques11 from threat tags

Technical details

Indicators of compromise

Domains 4

Hashes 1

Community reviews

Related threats