Threat reportMalwareTL-2026-1813

Atomic MacOS (AMOS) Stealer Infection via Fake "macOS Toolkit" Terminal Command

mediumACTIVE

Atomic MacOS (AMOS) Stealer Infection via Fake "macOS (TL-2026-1813), also tracked as Atomic Stealer, is a medium-severity malware campaign, first published 2026-08-02. It has no confirmed attribution, affects Apple macOS, maps to 24 MITRE ATT&CK techniques (T1005, T1027, T1027.010), and is covered by 9 detection rules and 36 indicators of compromise.

Severity
MEDIUMAssessed severity
CVEs
0None referenced
Techniques
24MITRE ATT&CK
Actors
0Not attributed
Detection rules
9SPL · KQL · Sigma
IOCs
36Indicators of compromise

Key facts for TL-2026-1813

Threat ID
TL-2026-1813
Also known as
Atomic Stealer, Atomic macOS Stealer
Severity
MEDIUM
Status
ACTIVE
Category
MALWARE
First published
Last reviewed
Attribution confidence
LOW
Motivation
FINANCIAL
Target sectors
consumer, cryptocurrency
Target regions
Global
Detection rules
9
Indicators of compromise
36

Malware and tooling in Atomic MacOS (AMOS) Stealer Infection via Fake "macOS

Malware and tooling: AMOS, Odyssey Stealer, Poseidon Stealer, Chainbreaker

How Atomic MacOS (AMOS) Stealer Infection via Fake "macOS works

SANS ISC (Brad Duncan) documented a live, self-infected AMOS (Atomic macOS Stealer) infection chain distributed through a spoofed "macOS toolkit" website, getmacouscloud[.]com, that tricks victims into pasting a malicious ClickFix-style Terminal command. The chain fetches a gzip/base64-encoded zsh dropper from render65[.]com that drops universal (x86_64/arm64) Mach-O payloads persisting under Apple-named Application Support directories, exfiltrating credentials, browser data, messenger data, and cryptocurrency wallet contents over unencrypted HTTP to a C2 server at 188.166.78[.]138.

On 2026-07-31, SANS Internet Storm Center handler Brad Duncan deliberately infected a lab macOS host by following the lure at getmacouscloud[.]com, a fake "macOS toolkit" site that instructs visitors to open Terminal and paste a supplied command rather than download and run a signed application — a variant of the ClickFix (MITRE T1204.004, "Malicious Copy and Paste") social-engineering pattern that has become one of the dominant initial-access vectors for macOS infostealers since March 2025. The initial lure chain observed includes macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304, getmacouscloud[.]com/?FSSbmnNdviEDE5S?io=16vwsb0rgIiPNIgM, and grove-89[.]com/api/metrics/run?event=pasted (a pasted-event telemetry beacon fired the moment the victim executes the pasted command). The pasted command retrieves a first-stage zsh script (SHA-256 b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c, 1,973 bytes) from render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9. That script contains a gzip-compressed, base64-encoded blob which, once deobfuscated, yields a second zsh script (SHA-256 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5, 1,227 bytes, fetched from render65[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update) responsible for downloading the actual AMOS payloads. Additional HTTPS traffic to macospheres[.]com was observed in the same session window.

The delivered malware consists of universal Mach-O binaries supporting both x86_64 and arm64 (Apple Silicon), first staged at /tmp/helper (297,952 bytes, SHA-256 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab) and then persisted as AccountsHelper (438,656 bytes, SHA-256 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836) under ~/Library/Application Support/.com.apple.accountsd/ and as mdworker_shared (503,152 bytes, SHA-256 01a0d5332b09bb299f7784bf0d0c43c4199269ed6a0712377279eeb999847d20) under ~/Library/Application Support/.com.apple.metadata.mds/. Both persistence paths masquerade as legitimate Apple system services (accountsd, mdworker) inside hidden, dot-prefixed directories — MITRE T1036.005 (Masquerading: Match Legitimate Name or Location) combined with T1564.001 (Hide Artifacts: Hidden Files and Directories).

Once running, the stealer communicates over plaintext HTTP (TCP/80, no TLS) to the C2 server 188.166.78[.]138, hitting a broader set of REST-style endpoints than initially catalogued: /api/metrics/run?event=started&stage=boot, /api/metrics/run?event=stage&stage=init_session, /api/metrics/run?event=stage=messengers, /api/metrics/run?event=stage&stage=credentials, /api/metrics/run?event=stage&stage=browsers, /api/metrics/run?event=stage&stage=wallets, /api/metrics/run?event=stage&stage=resolve_auth, /api/metrics/run?event=stage&stage=local_data, /contact, /api/join/, /api/bots/device-info, /api/tasks/ack, /api/feed/register (all HTTP POST), plus /api/tasks/r3dqbX7fptIT-gXz--D_nw?v=2.1 and /api/feed/items/49359f77ebb4ffd9a95568d27a8ff3e7 (HTTP GET). This staged tasking model — boot, init_session, messengers, credentials, browsers, wallets, resolve_auth, local_data — is consistent with the broader AMOS/Atomic macOS Stealer malware-as-a-service (MaaS) family, first advertised on Telegram in April 2023 for roughly $3,000/month and historically associated with the handle "ping3r" and a suspected Go-source-path developer identity "iluhaboltov" (Ilya Boltov, per Cyble research). AMOS pioneered the current wave of macOS credential/crypto stealers; one of its developers, tracked as Rodrigo4, later forked the codebase into Poseidon Stealer, which was itself rebranded as Odyssey Stealer — all three families share overlapping TTPs (AppleScript-based credential prompts, Keychain extraction via a bundled "Chainbreaker" utility, browser cookie/session theft, and cryptocurrency wallet targeting).

The wider macOS infostealer ecosystem AMOS sits in has evolved substantially since 2023: related stealer families Cthulhu and Banshee emerged in early 2024; Poseidon/Atomic activity proliferated through summer 2024; and by September 2024 SentinelOne documented RC4-encoded, hex-string-obfuscated variants alongside Apple XProtect signature coverage (MACOS_Soma_D, SOMA_E). Around October 2024, the dominant distribution tradecraft pivoted from DMG installers exploiting a Gatekeeper-bypass flaw to the ClickFix paste-and-run model now seen in this record. Rodrigo4's sale of Poseidon in November 2024 produced a development hiatus that ended in March 2025 when the codebase resurfaced as Odyssey Stealer. Red Canary distinguishes the two live lineages (Atomic vs. Odyssey/Poseidon) by concrete artifacts: curl BuildID casing (capitalized vs. lowercase), custom cl:0/cn:0 headers, staging filenames (com.finder.helper.plist, /tmp/app.zip vs. /tmp/ledger.zip, .init, Starter), and URL path conventions (/zxc/app.zip vs. /otherassets/ledger.zip). Microsoft's May 2026 reporting further documents three concurrent 2026 campaign waves feeding the same ecosystem: a January 2026 "Helper Campaign" (LaunchDaemon com.finder.helper.plist persistence, system_profiler-based QEMU/VMware/KVM virtualization detection), a February 2026 "Loader Campaign" (GoogleUpdate-masquerading LaunchAgent persistence, Russian/CIS-keyboard kill switch), and an April 2026 "Script Campaign" (stageless AppleScript C2 orchestration with Telegram-bot fallback at t.me/ax03bot), all hosted on throwaway domains and content platforms (Squarespace, Medium, Craft) and delivering AMOS, SHub Stealer, or Macsync via near-identical paste-and-run mechanics. A June 2026 BleepingComputer report documents a further related variant that silently mounts a DMG to push its infostealer payload. No CVE or software vulnerability is involved; the entire chain depends on user-driven execution via Terminal, and Apple's native protections (Gatekeeper, XProtect) do not intercept manually pasted shell commands. macOS 26.4+ adds a user-facing warning ("Possible malware, Paste blocked") when Terminal detects a suspicious paste, but this is a partial mitigation that does not block every execution path.

MITRE ATT&CK techniques used in TL-2026-1813

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1027.010 Command Obfuscation; T1036.005 Match Legitimate Resource Name or Location; T1070.004 File Deletion; T1140 Deobfuscate/Decode Files or Information; T1497 Virtualization/Sandbox Evasion; T1564.001 Hidden Files and Directories

Exfiltration

T1041 Exfiltration Over C2 Channel

Execution

T1059.002 AppleScript; T1059.004 Unix Shell; T1204.004 Malicious Copy and Paste

Command and Control

T1071.001 Web Protocols; T1105 Ingress Tool Transfer

Discovery

T1082 System Information Discovery; T1087.001 Local Account; T1217 Browser Information Discovery

command-and-control

T1132.001 Standard Encoding

Credential Access

T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers

Persistence

T1543.004 Launch Daemon

Privilege Escalation

T1543.004 Launch Daemon

Resource Development

T1583.001 Domains; T1583.006 Web Services

Affected products and versions in Atomic MacOS (AMOS) Stealer Infection via Fake "macOS

  • Apple — macOS
    Vulnerable versions: all macOS versions with Terminal.app and zsh available to the user
    Fixed in: macOS 26.4+ adds a user-facing suspicious-paste warning in Terminal (partial mitigation; does not block execution)

Remediation for Atomic MacOS (AMOS) Stealer Infection via Fake "macOS

Immediate actions

  • Block outbound network traffic to 188.166.78[.]138 (TCP/80) at perimeter firewalls and DNS resolvers
  • Sinkhole/block DNS resolution for getmacouscloud[.]com, macostruecloud[.]xyz, macospheres[.]com, render65[.]com, and grove-89[.]com
  • Hunt endpoint telemetry for the SHA-256 hashes of the zsh droppers and Mach-O payloads listed in this record
  • Inspect ~/Library/Application Support/ for hidden, Apple-named directories (e.g. .com.apple.accountsd, .com.apple.metadata.mds) containing unsigned or recently-created binaries
  • Force credential rotation (browser-saved passwords, Keychain items, exchange/wallet seed phrases) for any user confirmed to have run a pasted Terminal command from an untrusted site

Workarounds

  • Disable clipboard auto-paste / require explicit confirmation before Terminal executes pasted multi-line commands where organizational tooling supports it
  • Educate users that no legitimate macOS utility, update, or CAPTCHA verification requires pasting a command into Terminal

Longer-term hardening

  • Deploy EDR with behavioral detection for zsh/bash child processes spawned from Terminal.app immediately after clipboard paste events
  • Enforce macOS 26.4+ (or later) fleet-wide to enable native suspicious-paste warnings in Terminal
  • User-awareness training specifically targeting ClickFix / fake-CAPTCHA / fake-toolkit paste-and-run lures
  • Restrict or monitor use of curl | sh / curl | bash and equivalent pipe-to-shell execution patterns via endpoint policy
  • Maintain a MaaS-family detection baseline (AMOS/Poseidon/Odyssey) covering Chainbreaker-style Keychain access, LaunchAgent/LaunchDaemon persistence, and HTTP-based C2 beaconing

Timeline of Atomic MacOS (AMOS) Stealer Infection via Fake "macOS

  • Atomic macOS Stealer (AMOS) first advertised as a $3,000/month malware-as-a-service offering on Telegram under the seller handle "ping3r"; SentinelOne research links its origin to a repurposed ChatGPT-assisted development project.
  • Cthulhu Stealer and Banshee Stealer emerge as related macOS infostealer variants in early 2024, expanding the same credential/crypto-theft ecosystem AMOS operates in (SentinelOne).
  • Poseidon Stealer and Atomic (AMOS) variant activity proliferates through summer 2024, per SentinelOne's SOC detection guide comparing the two families.
  • SentinelOne documents RC4-encoded, hex-string-obfuscated AMOS/Poseidon variants and publishes a SOC detection guide distinguishing the families by static artifacts and Apple XProtect signature coverage (MACOS_Soma_D/SOMA_E).
  • AMOS/Poseidon distribution tradecraft shifts from DMG installers exploiting a Gatekeeper-bypass vulnerability to ClickFix-style 'paste-and-run' Terminal execution (Red Canary).
  • Developer "Rodrigo4" reportedly sells Poseidon Stealer, triggering a development hiatus in the family lasting into 2025 (Red Canary).
  • Poseidon Stealer resurfaces rebranded as Odyssey Stealer, ending the hiatus; Red Canary tracks Odyssey/Poseidon operational overlap from March through September 2025.
  • An AMOS campaign using the ClickFix (paste-and-run) technique to target Apple users is publicly reported (The Hacker News).
  • Microsoft observes two parallel AMOS-family campaign variants beginning in early 2026: a 'Helper Campaign' using LaunchDaemon (com.finder.helper.plist) persistence with system_profiler-based virtualization detection (QEMU/VMware/KVM), and a 'Loader Campaign' delivering a malicious GoogleUpdate-masquerading binary with LaunchAgent persistence and a Russian/CIS-keyboard kill switch.
  • Microsoft observes a 'Script Campaign' AMOS variant using stageless, disk-free AppleScript C2 orchestration with dynamic endpoint discovery and Telegram-bot (t.me/ax03bot) C2 fallback.
  • Microsoft Security publishes a consolidated analysis of the Loader, Helper, and Script ClickFix campaign variants delivering AMOS, SHub Stealer, and Macsync via fake macOS-utility lures hosted on Squarespace, Medium, and Craft.
  • BleepingComputer reports a related macOS ClickFix variant that silently mounts a disk image (DMG) to push an infostealer payload.
  • SANS ISC handler Brad Duncan deliberately infects a lab macOS host via the getmacouscloud[.]com fake 'macOS toolkit' lure, capturing the full infection chain and C2 traffic.
  • Threadlinqs Intelligence Platform ingests the SANS ISC report via RSS hunt and creates threat record TL-2026-1813.
  • SANS Internet Storm Center publishes Diary #33208 documenting the AMOS infection chain, associated domains, file hashes, and C2 server 188.166.78[.]138.

Sources cited for Atomic MacOS (AMOS) Stealer Infection via Fake "macOS

Detection coverage for TL-2026-1813

As of 2026-08-02, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1813 across Splunk SPL, Microsoft KQL and Sigma, covering 36 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

9 detection rules (Splunk SPL, Microsoft KQL, Sigma) · Blue and above. Compare plans
36 indicators of compromise · Red and above. Compare plans

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Live intelligence console

Threat level
Fig. 01 · Threat weatherIndexing the archive…
1 square = 1 threat · click to open

Latest Threats