Amos Stealer

Shown above: Malicious ad leading to page for AMOS Stealer.

"EU/EEA-focused malvertising was observed... Targets users searching for developer tools"

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.

An active malware distribution campaign abusing two prominent AI platforms Hugging Face and ClawHub to deliver trojans, cryptominers, and infostealers disguised as legitimate AI tools and agent extensions. The campaign marks a significant evolution in supply chain attacks, shifting from traditional software repositories to trusted AI ecosystems.

Shown above: Text from the fake Brew page pasted into a terminal Window.

The AMOS Stealer is a macOS malware known for its data theft capabilities, often delivered via an encrypted osascript (AppleScript) payload.

Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.

"Victims ... downloaded the installer from the altered link. On Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer."

When users install these packages without verifying, malicious payloads can be executed automatically, potentially installing malware.

MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.

MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.

For Windows targets, payloads were detected as trojans packed with VMProtect... A second Windows payload used a 30-byte XOR key to decrypt strings at runtime... The FAKESECURITY campaign used a batch script (CDC1.bat) containing an encoded PowerShell blob...

Shown above: Fake Homebrew (Brew) page.

After a successful upload, Amos Stealer runs the cleanup commands ( rm -f /tmp/osalogging.zip and rm -rf /tmp/sync ) to erase its presence.

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

Stealth and persistence Hides its execution by setting the Terminal window to invisible.

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.

Password collection Attempts to retrieve the user’s Chrome master password via the security command.

It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.

System Information : Captures hardware, software, and display details using system_profiler .

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

File Grabber : Collects files with specific extensions (e.g., .txt, .pdf, .docx, .wallet, .key) from Desktop, Documents, and Downloads folders

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

the malware uses a native macOS tool called ditto to compress the stolen files into a single archive named osalogging.zip inside the /tmp folder.

Archives stolen data into a ZIP file ( /tmp/out.zip ) and uploads it to a hardcoded C2

COMMAND AND CONTROL (T1071, T1102) VenomRAT → 178.22.24.175:4449; QuasarRAT → 178.22.24.175:4782; AsyncRAT → 178.22.24.175:2022

Researchers noted that the malware operators use a built-in macOS utility called curl to download the malicious files silently.

uploads it to a hardcoded C2 (command-and-control) server ( hxxp[://]95[.]164[.]53[.]3/contact ) via a curl POST request.

in the latest campaign, the threat actors are distributing the infostealer through deceptive software downloads, fake websites, and social engineering lures.