Loading story…
A malware bundle distributed as Steam_Machine_Checker.rar was found masquerading as a Steam brute-force utility while silently installing multiple malicious components, including the Osno stealer, a Bitcoin clipboard hijacker, and a cryptocurrency miner. After launch, the package displays a benign-looking GUI to reduce suspicion, while the stealer collects browser bookmarks, wallet data, Wi-Fi profile information, running processes, installed security software details, screenshots, and directory listings from the infected host.
The stolen data is exfiltrated through the Telegram Bot API, giving the operator a simple command-and-control and collection channel. The clipboard hijacker swaps Bitcoin addresses beginning with 1 for the attacker-controlled wallet 1LrPUuoopchKbfkJYLEwk2YWqBh6ZakTxX, while persistence is established through a Run registry key pointing to %AppData%\Roaming\scvhost\scvhostservice.exe. A fake svchost.exe component is also configured to mine Litecoin, turning infected systems into both data theft and illicit cryptomining assets.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
K7 Labs published an analysis of a malware bundle distributed as "Steam_Machine_Checker.rar" that posed as a Steam brute-force checker and delivered the Osno stealer, a Bitcoin clipboard hijacker, and a Litecoin miner. The report documented persistence, data theft, Telegram Bot API exfiltration, and the attacker-controlled Bitcoin replacement address used by the hijacker.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
**Atomic macOS Stealer (AMOS)** has emerged as a leading macOS infostealer sold as a malware-as-a-service offering on Telegram and used in campaigns that rely heavily on social engineering rather than exploits. Researchers found the Golang-based malware distributed in forms including malicious DMG installers and ClickFix-style lures that trick users into running Terminal commands, after which it captures or validates the victim’s macOS password, steals **Keychain** contents, browser credentials, cookies, autofill data, files, Apple Notes, extension storage, session tokens, system information, and cryptocurrency wallet data, then exfiltrates the results to attacker-controlled infrastructure and, in earlier observed versions, Telegram. Operators have advertised AMOS for **$1,000 per month** alongside add-on services such as a victim panel, crypto tooling, and installer support. Sophos said AMOS accounted for nearly **40%** of its macOS protection updates in 2025 and almost half of recent macOS stealer cases seen by customers, underscoring its scale and persistence. In one investigated intrusion, a bootstrap script fetched from `sphereou[.]com` downloaded a second-stage payload, performed anti-analysis checks, registered with command-and-control, and established persistence through a **LaunchDaemon** after obtaining elevated access. Earlier reporting tied AMOS infrastructure to `amos-malware[.]ru`, with exfiltration observed to `/sendlog`, while newer variants increasingly use AI-themed lures, fake installers, cracked apps, repeated password prompts, and fake Ledger and Trezor modules to broaden credential theft and cryptocurrency targeting.
Jun 29, 2026
Check Point Research detailed **BundleBot**, a stealer/bot malware family that uses the .NET single-file, self-contained bundle format and custom obfuscation to hinder static analysis and detection. The malware has been spread through **Facebook Ads** and compromised Facebook accounts that redirect users to phishing pages posing as utilities, AI tools, and games, then delivered through a multi-stage infection chain that includes a RAR downloader and a password-protected ZIP archive. Once installed, BundleBot steals browser data, **Facebook**, **Telegram**, and **Discord** information, along with system details and screenshots, and maintains persistence through the Windows `Run` registry key. Researchers said the malware communicates with command-and-control servers over TCP, with some variants using HTTPS, and assessed that multiple campaigns were likely run by the same threat actor, with stolen Facebook credentials potentially fueling continued propagation through newly hijacked accounts.
Aug 14, 2026
Threat researchers reported active cryptocurrency-focused malware campaigns that rely on social engineering and deceptive executables to steal funds or wallet-related secrets. One operation observed by CloudSEK targets **Discord** communities tied to gaming, gambling, and crypto streaming, where an actor tracked as **“RedLineCyber”** builds trust and privately shares Windows executables (e.g., `Pro.exe`, `peeek.exe`) pitched as streaming/security tools. After installation, the malware performs **clipboard hijacking**, monitoring for copied wallet addresses and swapping them with attacker-controlled addresses at paste time, enabling theft with minimal user-visible indicators and limited/no obvious command-and-control activity. Separately, Iru researcher **Calvin So** documented **MonetaStealer** on **macOS**, delivered as `Portfolio_Review.exe` but actually an **unsigned Mach-O** binary using a misleading `.exe` extension to exploit the assumption that Windows executables are harmless on Macs. The sample is **Python-based and bundled with PyInstaller**, with core logic hidden in a compressed `portfolio_app.pyc`, and was reported as having **zero detections on VirusTotal** at the time of analysis. MonetaStealer is designed to steal cryptocurrency wallet data along with browser secrets and **Keychain** information, and appears to be early-stage malware with indications of AI-assisted code structure.
Jun 29, 2026