AMOS is a macOS-based information stealer distributed through malicious websites that instruct users to paste commands into Terminal. The malware targets sensitive information, including browser credentials, messenger data, and cryptocurrency wallets. It establishes persistence using Mach-O binaries concealed within Application Support directories.
The investigation was based on a lab-generated infection conducted on July 31, 2026. The researcher observed repeated initial infection traffic caused by executing the malicious command multiple times and identified several persistent Mach-O binaries stored across different directories. Network analysis also revealed C2 communication through HTTP POST and GET requests sent to a specific IP address.
Users should be trained never to paste arbitrary commands from untrusted websites into macOS Terminal. Organizations should monitor for suspicious command-line activity and unauthorized file creation in /tmp and Library/Application Support directories. Network monitoring should also detect outbound HTTP connections to unknown or suspicious IP addresses and domains.
If an AMOS infection is detected, the affected macOS device should be isolated immediately to stop further data exfiltration. Investigators should identify all persistent Mach-O binaries and recover deleted artifacts from the /tmp directory. Passwords for every account accessed from the compromised system should be reset, including browser-stored credentials and cryptocurrency wallet accounts.
Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.
Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.
Attack Narrative & Commands: The adversary seeks to deploy the AMOS stealer to harvest credentials. After gaining initial access via a user executing a malicious attachment (T1204.004), the malware ensures it survives reboots by creating a registry run key (T1546.014). To avoid detection by advanced sandboxes, the malware uses basic obfuscation (T1027.012). Finally, the malware initiates an unencrypted HTTP POST request to the hardcoded C2 IP 188.166.78.138 to exfiltrate the local browser profile data. This specific action is intended to trigger the proxy-based detection rule.
Regression Test Script:
Join SOC Prime's Detection as Code platform to improve visibility into threats most relevant to your business. To help you get started and drive immediate value, book a meeting now with SOC Prime experts.
The full story
This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.
