Reddit NetSec

AlienVault OTX General

CVE Database V5

Reddit InfoSec News

Exploit-DB RSS Feed

ThreatFox MISP Feed

CIRCL OSINT Feed

AlienVault OTX Vulnerabilities

AlienVault OTX Malware

This analysis examines a campaign distributing Atomic macOS Stealer (AMOS), targeting macOS users through fake 'cracked' applications. Attackers use two main delivery methods: malicious .dmg installers and terminal commands that bypass Gatekeeper protection. AMOS employs rotating domains to evade detection and steals a wide range of sensitive data, including credentials, browser information, cryptocurrency wallets, and system files. The campaign demonstrates sophisticated tactics, adapting to macOS security improvements and leveraging social engineering. The report emphasizes the importance of comprehensive endpoint detection, user education, and defense-in-depth strategies to combat such threats.

The AMOS Stealer campaign is a sophisticated malware operation targeting macOS users by distributing the Atomic macOS Stealer (AMOS) through fake 'cracked' applications. These applications are typically pirated or unauthorized versions of legitimate software, which lure users into installing malicious payloads. The attackers employ two primary delivery mechanisms: malicious .dmg installer files and terminal commands that bypass macOS's Gatekeeper security feature, which is designed to prevent untrusted software from running. By circumventing Gatekeeper, the malware can execute without triggering standard macOS security warnings, increasing the likelihood of successful infection.

AMOS uses rotating domains to evade detection and takedown efforts, making it harder for defenders to block its command and control (C2) infrastructure. Once installed, AMOS collects a broad spectrum of sensitive information, including user credentials, browser data, cryptocurrency wallets, and system files. This data exfiltration enables attackers to compromise user accounts, steal digital assets, and gain deeper access to the victim's environment.

The campaign demonstrates advanced tactics such as persistence mechanisms to maintain foothold on infected systems and social engineering techniques to trick users into executing malicious installers or commands. The malware leverages multiple MITRE ATT&CK techniques, including input capture (T1056.001), user execution (T1204.002), scheduled task execution (T1053.003), and obfuscated files or information (T1027), among others. These tactics show adaptability to macOS security enhancements and a focus on stealth and resilience.

The analysis highlights the importance of comprehensive endpoint detection and response (EDR) capabilities, user awareness training to avoid installing unauthorized software, and layered defense strategies to detect and mitigate such threats effectively. The campaign's use of social engineering and Gatekeeper bypass techniques underscores the need for vigilance even on platforms traditionally considered more secure like macOS.

Detailed information about An Analysis of the AMOS Stealer Campaign Targeting macOS via 'Cracked' Apps. Get real-time updates, technical details, and mitigation

Title	Severity	Type	Source	Date

Threats Tagged 'gatekeeper bypass'

Filter Threats

Threats Tagged 'gatekeeper bypass'

Keyboard Shortcuts

Navigation

Search & Filters

UI Controls

Accessibility