Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)
Source SANS ISC Handlers Diary
Description
Introduction
Impact
The AMOS stealer malware can steal data from infected macOS hosts and maintain persistence. It communicates with attacker-controlled command-and-control servers to exfiltrate information and receive commands. The infection compromises the confidentiality and integrity of the affected system's data. There is no evidence of exploitation in the wild beyond the lab-generated infection, and no direct patch or software vulnerability is involved.
Defensive guidance
Mitigation focuses on user education to avoid executing untrusted commands in the Terminal and blocking access to known malicious URLs and IP addresses associated with the AMOS stealer. Endpoint detection and response solutions should be updated to detect the identified file hashes and network indicators. Monitor for suspicious Terminal activity and unauthorized persistence mechanisms on macOS hosts.
Summary
AMOS stealer infection occurs when a user visits a malicious web page (getmacouscloud[.]com) and is instructed to paste a command into the macOS Terminal. This command downloads and installs the AMOS stealer malware, which persists on the system and exfiltrates data via HTTP POST and GET requests to a command-and-control server at IP 188.166.78.138. The infection involves multiple files including Mach-O universal binaries and scripts stored in temporary and user library directories. The infection traffic and file hashes have been documented by the SANS Internet Storm Center. There is no indication of a vulnerability exploited in software; rather, this is a social engineering and malware infection vector.
References
Community reviews
Related threats
- ZDI-26-831: Apple macOS CoreText GDEF LigCaretList Out-Of-Bounds Read Information Disclosure VulnerabilityLowVulnerability
- iOS, macOS 27.2 Patch 286 Bugs; Fix for Exploited Flaw Backported to iOS 18HighVulnerability
- Inside the LiteLLM 1.107.0 supply chain compromise: Credential theft through Python startup hooksHighVulnerability
- In Other News: Tor Exit Relays Hijacked, Banks Spot Rogue AI Agents, Self-Rebuilding macOS RansomwareAnalysis
- Apple to Tighten Full Disk Access Controls in macOS Amid AI RisksNews