Amos Stealer
AMOS Stealer is a macOS-focused information stealer targeting Apple Mac systems. The content describes it as a prominent and highly active malware family, commonly sold as malware-as-a-service through Telegram and underground forums, and used in financially motivated campaigns. It steals browser passwords, session cookies, and autofill data from browsers including Google Chrome and Microsoft Edge on macOS, copies the macOS Keychain database file login.keychain-db to access saved credentials, and searches the user home directory for sensitive files such as .kube, .ssh, .zshrc, and .gitconfig. Observed tradecraft includes use of native macOS utilities such as curl, zsh, AppleScript, ditto, and OpenSSL to download payloads, collect data, compress it into /tmp/osalogging.zip, split archives into 10 MB chunks, generate upload session IDs, exfiltrate data via HTTP PUT, retry failed uploads, and remove artifacts such as /tmp/osalogging.zip and /tmp/sync after successful theft. One reported exfiltration destination was the attacker-controlled domain bestbuydomain.com. The malware has been distributed through deceptive software downloads, fake websites, social-engineering lures, cracked apps, malvertising, compromised websites, fake GitHub repository download links, AI-platform abuse, and ClickFix-style lures. Specific delivery contexts in the content include ClearFake campaigns on compromised websites, Bash-based ClickFix lures, malicious OpenClaw/ClawHub skills that used a base64-encoded command to connect to 91.92.242[.]30 and download the payload, and SEO-poisoned or AI-poisoned search results leading users to malicious ChatGPT and Grok conversations or LLM-written tutorials that trick victims into executing malicious macOS Terminal commands. The content also states that AMOS Stealer uses macOS Login Items persistence via the com.apple.loginwindow AutoLaunchedApplicationDictionary mechanism. Infrastructure references in the content include 91.92.242[.]30, bestbuydomain.com, and domains systellis.com and wusetail.com. The malware has been observed alongside or within broader ecosystems involving ClearFake, ShadowSyndicate-linked infrastructure, and neighboring hosting associated with Rhadamanthys, DCRat, HijackLoader, Lumma, Vidar, and other malware families. The described impact includes credential theft, persistent malware infection, data exfiltration, exposure of corporate credentials, and potential data breaches and financial theft.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Techniques & procedures
23 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
2 techniques
Resource Development
Initial Access
2 techniques
Initial Access
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.
An active malware distribution campaign abusing two prominent AI platforms Hugging Face and ClawHub to deliver trojans, cryptominers, and infostealers disguised as legitimate AI tools and agent extensions. The campaign marks a significant evolution in supply chain attacks, shifting from traditional software repositories to trusted AI ecosystems.
Execution
5 techniques
Execution
Shown above: Text from the fake Brew page pasted into a terminal Window.
Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.
Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.
Persistence
1 technique
Persistence
MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.
Privilege Escalation
1 technique
Privilege Escalation
MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.
Stealth
3 techniques
Stealth
For Windows targets, payloads were detected as trojans packed with VMProtect... A second Windows payload used a 30-byte XOR key to decrypt strings at runtime... The FAKESECURITY campaign used a batch script (CDC1.bat) containing an encoded PowerShell blob...
Credential Access
3 techniques
Credential Access
It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.
Collection
3 techniques
Collection
It also searches the user’s home path for confidential developer configuration files and keys, including .kube, .ssh, .zshrc , and .gitconfig .
Command and Control
2 techniques
Command and Control
Exfiltration
1 technique
Exfiltration
IOCs tracked for this family
14 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
Recent activity
22 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS-focused information stealer used in financially motivated campaigns. It steals browser passwords, session cookies, autofill data, copies the macOS Keychain database, collects developer configuration files and keys, compresses stolen data, exfiltrates it to attacker-controlled infrastructure via curl, and removes artifacts afterward.
A macOS-focused infostealer delivered in this campaign via malicious AI platform content; it is described as being sold as malware-as-a-service through Telegram and underground forums.
A macOS-focused infostealer distributed via malicious OpenClaw skills in this campaign. It is delivered through staged shell scripts that download and execute the payload from attacker-controlled infrastructure.
macOS infostealer delivered via a malvertising + GitHub repository abuse chain that redirects victims to a malicious commit/README download link for a trojanized installer.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.