Amos Stealer

Shown above: Malicious ad leading to page for AMOS Stealer.

"EU/EEA-focused malvertising was observed... Targets users searching for developer tools"

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.

An active malware distribution campaign abusing two prominent AI platforms Hugging Face and ClawHub to deliver trojans, cryptominers, and infostealers disguised as legitimate AI tools and agent extensions. The campaign marks a significant evolution in supply chain attacks, shifting from traditional software repositories to trusted AI ecosystems.

Shown above: Text from the fake Brew page pasted into a terminal Window.

The AMOS Stealer is a macOS malware known for its data theft capabilities, often delivered via an encrypted osascript (AppleScript) payload.

Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.

The sidebar provided two follow-on options: ClickFix-style instructions and a download option, both intended to download and execute malicious code.

This involved a Google Doc featuring a custom Google Apps Script sidebar designed to guide them through the execution of malware.

AMOS has been distributed through ClickFix campaigns, malicious advertisements, and websites offering cracked versions of popular software. These sites use fake installation instructions, such as a supposed macOS toolkit, to trick users into installing the malware.

MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.

MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.

For Windows targets, payloads were detected as trojans packed with VMProtect... A second Windows payload used a 30-byte XOR key to decrypt strings at runtime... The FAKESECURITY campaign used a batch script (CDC1.bat) containing an encoded PowerShell blob...

This analysis examines an AMOS Stealer infection ... delivered through a page promoting a fake “macOS toolkit.”

After a successful upload, Amos Stealer runs the cleanup commands ( rm -f /tmp/osalogging.zip and rm -rf /tmp/sync ) to erase its presence.

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

Stealth and persistence Hides its execution by setting the Terminal window to invisible.

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.

Password collection Attempts to retrieve the user’s Chrome master password via the security command.

It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.

It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

the malware uses a native macOS tool called ditto to compress the stolen files into a single archive named osalogging.zip inside the /tmp folder.

Archives stolen data into a ZIP file ( /tmp/out.zip ) and uploads it to a hardcoded C2

COMMAND AND CONTROL (T1071, T1102) VenomRAT → 178.22.24.175:4449; QuasarRAT → 178.22.24.175:4782; AsyncRAT → 178.22.24.175:2022

Researchers noted that the malware operators use a built-in macOS utility called curl to download the malicious files silently.

uploads it to a hardcoded C2 (command-and-control) server ( hxxp[://]95[.]164[.]53[.]3/contact ) via a curl POST request.

in the latest campaign, the threat actors are distributing the infostealer through deceptive software downloads, fake websites, and social engineering lures.