# Atomic MacOS (AMOS) Stealer Infection via Fake "macOS Toolkit" Terminal Command

> SANS ISC (Brad Duncan) documented a live, self-infected AMOS (Atomic macOS Stealer) infection chain distributed through a spoofed "macOS toolkit" website, getmacouscloud[.]com, that tricks victims into pasting a malicious ClickFix-style Terminal command. The chain fetches a gzip/base64-encoded zsh dropper from render65[.]com that drops universal (x86_64/arm64) Mach-O payloads persisting under Apple-named Application Support directories, exfiltrating credentials, browser data, messenger data, and cryptocurrency wallet contents over unencrypted HTTP to a C2 server at 188.166.78[.]138.

- **Published:** 2026-08-02T00:00:00Z
- **Last reviewed:** 2026-08-02T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-1813
- **ID:** TL-2026-1813
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 36 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-07-31, SANS Internet Storm Center handler Brad Duncan deliberately infected a lab macOS host by following the lure at getmacouscloud[.]com, a fake "macOS toolkit" site that instructs visitors to open Terminal and paste a supplied command rather than download and run a signed application — a variant of the ClickFix (MITRE T1204.004, "Malicious Copy and Paste") social-engineering pattern that has become one of the dominant initial-access vectors for macOS infostealers since March 2025. The initial lure chain observed includes macostruecloud[.]xyz/?h=2f9548d041648a8030c040ae0e1e530b&z=304, getmacouscloud[.]com/?FSSbmnNdviEDE5S?io=16vwsb0rgIiPNIgM, and grove-89[.]com/api/metrics/run?event=pasted (a pasted-event telemetry beacon fired the moment the victim executes the pasted command). The pasted command retrieves a first-stage zsh script (SHA-256 b9ec3261d633c289e51c5fa8842af4350efe68446df39cb995de82e0941d0f3c, 1,973 bytes) from render65[.]com/curl/f5509695dd98a9732378e5256d6235415d64d92194459bb08525c7ce5991a0c9. That script contains a gzip-compressed, base64-encoded blob which, once deobfuscated, yields a second zsh script (SHA-256 13b868b3ea8b492e7fbab1ca04535c53d0930650185b5a082cd59c1974689cd5, 1,227 bytes, fetched from render65[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update) responsible for downloading the actual AMOS payloads. Additional HTTPS traffic to macospheres[.]com was observed in the same session window.

The delivered malware consists of universal Mach-O binaries supporting both x86_64 and arm64 (Apple Silicon), first staged at /tmp/helper (297,952 bytes, SHA-256 9f25ec533cb23d020e568fb771500d7776b1300f07119ad9d0876f4329ce22ab) and then persisted as AccountsHelper (438,656 bytes, SHA-256 0a03cf18de28017c0ea591dffc380a6b41fedd2acc3a39e901e58d9188c01836) under ~/Library/Application Support/.com.apple.accountsd/ and as mdworker_shared (503,152 bytes, SHA-256 01a0d5332b09bb299f7784bf0d0c43c4199269ed6a0712377279eeb999847d20) under ~/Library/Application Support/.com.apple.metadata.mds/. Both persistence paths masquerade as legitimate Apple system services (accountsd, mdworker) inside hidden, dot-prefixed directories — MITRE T1036.005 (Masquerading: Match Legitimate Name or Location) combined with T1564.001 (Hide Artifacts: Hidden Files and Directories).

Once running, the stealer communicates over plaintext HTTP (TCP/80, no TLS) to the C2 server 188.166.78[.]138, hitting a broader set of REST-style endpoints than initially catalogued: /api/metrics/run?event=started&stage=boot, /api/metrics/run?event=stage&stage=init_session, /api/metrics/run?event=stage=messengers, /api/metrics/run?event=stage&stage=credentials, /api/metrics/run?event=stage&stage=browsers, /api/metrics/run?event=stage&stage=wallets, /api/metrics/run?event=stage&stage=resolve_auth, /api/metrics/run?event=stage&stage=local_data, /contact, /api/join/, /api/bots/device-info, /api/tasks/ack, /api/feed/register (all HTTP POST), plus /api/tasks/r3dqbX7fptIT-gXz--D_nw?v=2.1 and /api/feed/items/49359f77ebb4ffd9a95568d27a8ff3e7 (HTTP GET). This staged tasking model — boot, init_session, messengers, credentials, browsers, wallets, resolve_auth, local_data — is consistent with the broader AMOS/Atomic macOS Stealer malware-as-a-service (MaaS) family, first advertised on Telegram in April 2023 for roughly $3,000/month and historically associated with the handle "ping3r" and a suspected Go-source-path developer identity "iluhaboltov" (Ilya Boltov, per Cyble research). AMOS pioneered the current wave of macOS credential/crypto stealers; one of its developers, tracked as Rodrigo4, later forked the codebase into Poseidon Stealer, which was itself rebranded as Odyssey Stealer — all three families share overlapping TTPs (AppleScript-based credential prompts, Keychain extraction via a bundled "Chainbreaker" utility, browser cookie/session theft, and cryptocurrency wallet targeting).

The wider macOS infostealer ecosystem AMOS sits in has evolved substantially since 2023: related stealer families Cthulhu and Banshee emerged in early 2024; Poseidon/Atomic activity proliferated through summer 2024; and by September 2024 SentinelOne documented RC4-encoded, hex-string-obfuscated variants alongside Apple XProtect signature coverage (MACOS_Soma_D, SOMA_E). Around October 2024, the dominant distribution tradecraft pivoted from DMG installers exploiting a Gatekeeper-bypass flaw to the ClickFix paste-and-run model now seen in this record. Rodrigo4's sale of Poseidon in November 2024 produced a development hiatus that ended in March 2025 when the codebase resurfaced as Odyssey Stealer. Red Canary distinguishes the two live lineages (Atomic vs. Odyssey/Poseidon) by concrete artifacts: curl BuildID casing (capitalized vs. lowercase), custom cl:0/cn:0 headers, staging filenames (com.finder.helper.plist, /tmp/app.zip vs. /tmp/ledger.zip, .init, Starter), and URL path conventions (/zxc/app.zip vs. /otherassets/ledger.zip). Microsoft's May 2026 reporting further documents three concurrent 2026 campaign waves feeding the same ecosystem: a January 2026 "Helper Campaign" (LaunchDaemon com.finder.helper.plist persistence, system_profiler-based QEMU/VMware/KVM virtualization detection), a February 2026 "Loader Campaign" (GoogleUpdate-masquerading LaunchAgent persistence, Russian/CIS-keyboard kill switch), and an April 2026 "Script Campaign" (stageless AppleScript C2 orchestration with Telegram-bot fallback at t.me/ax03bot), all hosted on throwaway domains and content platforms (Squarespace, Medium, Craft) and delivering AMOS, SHub Stealer, or Macsync via near-identical paste-and-run mechanics. A June 2026 BleepingComputer report documents a further related variant that silently mounts a DMG to push its infostealer payload. No CVE or software vulnerability is involved; the entire chain depends on user-driven execution via Terminal, and Apple's native protections (Gatekeeper, XProtect) do not intercept manually pasted shell commands. macOS 26.4+ adds a user-facing warning ("Possible malware, Paste blocked") when Terminal detects a suspicious paste, but this is a partial mitigation that does not block every execution path.

## MITRE ATT&CK

- T1583.001 Domains
- T1583.006 Web Services
- T1204.004 Malicious Copy and Paste
- T1059.004 Unix Shell
- T1059.002 AppleScript
- T1543.004 Launch Daemon
- T1543.004 Launch Daemon
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1027.010 Command Obfuscation
- T1132.001 Standard Encoding
- T1036.005 Match Legitimate Resource Name or Location
- T1564.001 Hidden Files and Directories
- T1497 Virtualization/Sandbox Evasion
- T1070.004 File Deletion
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1087.001 Local Account
- T1217 Browser Information Discovery
- T1005 Data from Local System
- T1105 Ingress Tool Transfer
- T1071.001 Web Protocols
- T1041 Exfiltration Over C2 Channel

## Sources

- [Atomic MacOS (AMOS) stealer infection](https://isc.sans.edu/diary/33208)
- [ClickFix campaign uses fake macOS utilities lures to deliver infostealers](https://www.microsoft.com/en-us/security/blog/2026/05/06/clickfix-campaign-uses-fake-macos-utilities-lures-deliver-infostealers/)
- [New Atomic macOS Stealer Campaign Exploits ClickFix to Target Apple Users](https://thehackernews.com/2025/06/new-atomic-macos-stealer-campaign.html)
- [New macOS ClickFix attack silently mounts DMGs to push infostealer](https://www.bleepingcomputer.com/news/security/new-macos-clickfix-attack-silently-mounts-dmgs-to-push-infostealer/)
- [Distinguishing Atomic, Odyssey, and Poseidon stealers on macOS](https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/)
- [Atomic Stealer: Dissecting 2024's Most Notorious macOS Infostealer](https://www.picussecurity.com/resource/blog/atomic-stealer-amos-macos-threat-analysis)
- [New Atomic MacOS Stealer For Sale On Telegram](https://cyble.com/blog/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/)
- [From Amos to Poseidon | A SOC Team's Guide to Detecting macOS Atomic Stealers 2024](https://www.sentinelone.com/blog/from-amos-to-poseidon-a-soc-teams-guide-to-detecting-macos-atomic-stealers-2024/)
- [User Execution: Malicious Copy and Paste, Sub-technique T1204.004](https://attack.mitre.org/techniques/T1204/004/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-1813