Links submitted by the Threat Radar community and AI curated for defenders.

Community Curated

CVE Database V5

AlienVault OTX General

Real-world exploitation and exposure telemetry from the OffSeq Mirage honeypot fleet and Sonar internet scans — which CVEs attackers are actually exploiting and which are exposed in the wild, plus attacker IoCs. All IPs are masked; no raw victim or sensor identity is ever published.

OffSeq Mirage

Bleeping Computer

SANS ISC Handlers Diary

SecurityWeek

Threatpost

Latest exploits, shellcode, and vulnerability proofs-of-concept from Exploit-DB

Exploit-DB RSS Feed

Reddit ExploitDev

Reddit ThreatIntel

Reddit BlueTeam

Reddit Reverse Engineering

Reddit Malware

Reddit Cybersecurity

Reddit NetSec

ThreatFox MISP Feed

CIRCL OSINT Feed

NCSC UK

JVN Japan

GCP Compute Engine Security

GCP Kubernetes Security

AWS Security Bulletins

CERT/CC

Tenable Research

Google Project Zero

Microsoft Security Blog

Zero Day Initiative

Cisco Talos

Palo Alto Unit 42

Krebs on Security

Kaspersky Security Blog

Check Point Research

GCVE Database

Reddit InfoSec News

The Hacker News

Dark Reading

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines a campaign distributing Atomic macOS Stealer (AMOS), targeting macOS users through fake 'cracked' applications. Attackers use two main delivery methods: malicious .dmg installers and terminal commands that bypass Gatekeeper protection. AMOS employs rotating domains to evade detection and steals a wide range of sensitive data, including credentials, browser information, cryptocurrency wallets, and system files. The campaign demonstrates sophisticated tactics, adapting to macOS security improvements and leveraging social engineering. The report emphasizes the importance of comprehensive endpoint detection, user education, and defense-in-depth strategies to combat such threats.

The AMOS Stealer campaign is a sophisticated malware operation targeting macOS users by distributing the Atomic macOS Stealer (AMOS) through fake 'cracked' applications. These applications are typically pirated or unauthorized versions of legitimate software, which lure users into installing malicious payloads. The attackers employ two primary delivery mechanisms: malicious .dmg installer files and terminal commands that bypass macOS's Gatekeeper security feature, which is designed to prevent untrusted software from running. By circumventing Gatekeeper, the malware can execute without triggering standard macOS security warnings, increasing the likelihood of successful infection.

AMOS uses rotating domains to evade detection and takedown efforts, making it harder for defenders to block its command and control (C2) infrastructure. Once installed, AMOS collects a broad spectrum of sensitive information, including user credentials, browser data, cryptocurrency wallets, and system files. This data exfiltration enables attackers to compromise user accounts, steal digital assets, and gain deeper access to the victim's environment.

The campaign demonstrates advanced tactics such as persistence mechanisms to maintain foothold on infected systems and social engineering techniques to trick users into executing malicious installers or commands. The malware leverages multiple MITRE ATT&CK techniques, including input capture (T1056.001), user execution (T1204.002), scheduled task execution (T1053.003), and obfuscated files or information (T1027), among others. These tactics show adaptability to macOS security enhancements and a focus on stealth and resilience.

The analysis highlights the importance of comprehensive endpoint detection and response (EDR) capabilities, user awareness training to avoid installing unauthorized software, and layered defense strategies to detect and mitigate such threats effectively. The campaign's use of social engineering and Gatekeeper bypass techniques underscores the need for vigilance even on platforms traditionally considered more secure like macOS.

Detailed information about An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps. Get real-time updates, technical details, and mitigation

An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps - Live Threat Intelligence - Threat Radar | OffSeq.com

An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps

Threats Tagged 'cracked apps'

Stop chasing alerts. Route them.

Check if your credentials are on the dark web

Filter Threats

Threats Tagged 'cracked apps'

Lead Pen Test Professional