Threat reportMalwareTL-2026-3618
QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom Busters
QuoIntelligence Weekly Snapshot W34 2026 (TL-2026-3618), also tracked as AmnesiaStealer, is a medium-severity malware campaign, first published 2026-10-15. It has no confirmed attribution, affects Apple macOS, maps to 18 MITRE ATT&CK techniques (T1005, T1036, T1056.002), and is covered by 9 detection rules and 29 indicators of compromise.
- Severity
- MEDIUMAssessed severity
- CVEs
- 0None referenced
- Techniques
- 18MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 29Indicators of compromise
Key facts for TL-2026-3618
- Threat ID
- TL-2026-3618
- Also known as
- AmnesiaStealer, ErrTraffic, StubMaker, Ransom Busters
- Severity
- MEDIUM
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- technology, software-development, cryptocurrency, general-consumer, enterprise
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 29
Malware and tooling in QuoIntelligence Weekly Snapshot W34 2026
Malware and tooling: Vidar, Remotely, SoftPerfect Network Scanner, s5cmd
How QuoIntelligence Weekly Snapshot W34 2026 works
QuoIntelligence's Week 34 2026 snapshot highlights four financially motivated threats: the AmnesiaStealer macOS infostealer spread via a counterfeit GitHub page, the ErrTraffic MaaS combining EtherHiding and ClickFix, typosquatted RubyGems packages stealing browser credentials and crypto wallets, and Ransom Busters, a rogue ransomware affiliate posing as a recovery firm.
This record consolidates the four malware/fraud items named in QuoIntelligence's Threat Intelligence Snapshot for Week 34 2026 (published 2026-08-21; the public page lists headlines only), enriched from primary vendor reporting.
AmnesiaStealer (Jamf Threat Labs, 2026-08-13): a multi-stage, Rust-based macOS infostealer distributed through a counterfeit GitHub download page (github.aoitour.com) that instructs the victim to paste a base64-encoded command into Terminal and enter their device password. Stage 1 is a Mach-O dropper/stealer that shows a fake macOS login prompt to capture the user password, validates it (dscl), unlocks the Keychain, and harvests Chromium-browser data (Chrome, Brave, Arc, Edge, Opera, Vivaldi, Chromium), Safari cookies, Apple Notes and Telegram data, staging in /tmp and archiving with ditto. It removes quarantine attributes, ad-hoc signs itself, abuses mounted Time Machine/APFS snapshots to read TCC-protected data and modifies a copy of the TCC database, and persists through a LaunchDaemon masquerading as Apple crash reporting. Tasking is polled over an HTTP API (/api/bot/join, /api/bot/actions, /send/) against an 'Amnesia Panel' backend. Stage 2 (stream_module) uses Chrome DevTools Protocol and a WebSocket relay to give the operator live, hidden control of the victim's cloned browser profile (navigate, mouse_click, export_cookies, tabs).
ErrTraffic (Securonix 2026-06-17; WatchGuard 2026-08-10): a Malware-as-a-Service traffic distribution framework first advertised on Russian-language cybercrime forums in December 2025 by the handle LenAI, with 2026 pricing of roughly $300-$380 per month and $1,500-$4,500 for source code. It injects ClickFix lures (fake browser/CAPTCHA glitches that copy a PowerShell command to the clipboard via navigator.clipboard.writeText and prompt the victim to run it via Win+R) into compromised WordPress sites, and resolves its C2/payload domains dynamically through EtherHiding: smart contracts on Polygon and BNB Smart Chain queried read-only with eth_call (via Polygon RPC providers such as Quicknode) act as dead drop resolvers, with C2 rotation about daily. Delivered families include Vidar, Stealc, Remus, Salat, SmokeLoader, DanaBot, HijackLoader, GULoader, Okobot, LegionLoader, OnionDrop, BabaDedaLoader and a NodeJS backdoor using gRPC over Tor. Tradecraft includes payload URLs of the form api/index.php?a=dl&token=<64 chars>, DLL side-loading through legitimate executables, remote-thread injection into Chrome/Edge, rundll32 ordinal-export execution, and 120+ MB archives to evade sandbox size limits. The framework sets an errtraffic_session cookie, which is a useful identification pivot.
Malicious RubyGems packages (StubMaker, reported via OpenSourceMalware / The Hacker News, discovery 2026-08-15): 16 typosquatted gems (e.g. ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef) published under throwaway accounts in a two-day sequential pattern. An extconf.rb hook runs at gem install time, fetches a 22 MB Rust loader which unpacks a Go-based stealer ('wincfg') that steals Chromium-browser credentials, cookies and extensions, payment cards, cryptocurrency wallets and seed phrases, Telegram Desktop data and system information on Windows, geolocates the host via api.ipify.org, contacts dresslee.com, and exfiltrates password-protected ZIPs to Gofile.
Ransom Busters (GuidePoint Security GRIT, reported by BleepingComputer 2026-08-19): an entity contacting ransomware victims, sometimes before an incident became public, offering decryption keys and stolen-data deletion for $20,000-$60,000 for incidents involving DragonForce, Settra and Anubis. GRIT assesses with moderate confidence that it is a single rogue ransomware affiliate abusing insider/RaaS-panel access to divert payments. Overlapping forensic artifacts across incidents: SoftPerfect Network Scanner, s5cmd, the Remotely remote-monitoring tool, a local backdoor account with password 'Numlock!123' and attacker hostname DESKTOP-BBETH6K. No victim payments to Ransom Busters were confirmed.
No CVE, CVSS score or KEV entry is associated with these items; severity is a conservative MEDIUM. Attribution of the individual items is not established beyond the ErrTraffic seller handle (LenAI) and GRIT's affiliate assessment. The snapshot also covers geopolitical items that are out of scope for this record.
MITRE ATT&CK techniques used in TL-2026-3618
Collection
Defense Evasion
T1036 Masquerading; T1218.011 System Binary Proxy Execution: Rundll32; T1574.001 DLL
Credential Access
T1056.002 Input Capture: GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Credentials from Password Stores: Keychain; T1555.003 Credentials from Password Stores: Credentials from Web Browsers
Execution
T1059.001 Command and Scripting Interpreter: PowerShell; T1059.004 Command and Scripting Interpreter: Unix Shell; T1204.004 User Execution: Malicious Copy and Paste
Initial Access
T1195.001 Compromise Software Dependencies and Development Tools
Command and Control
T1219 Remote Access Tools; T1568 Dynamic Resolution
Persistence
T1543.004 Create or Modify System Process: Launch Daemon
defense-impairment
T1553.001 Subvert Trust Controls: Gatekeeper Bypass
Exfiltration
T1567 Exfiltration Over Web Service
Impact
Affected products and versions in QuoIntelligence Weekly Snapshot W34 2026
- Apple — macOS
Vulnerable versions: Users who run the pasted Terminal command (AmnesiaStealer) - Microsoft — Windows
Vulnerable versions: Hosts where users run ClickFix PowerShell commands (ErrTraffic) or install StubMaker gems - RubyGems — RubyGems package registry
Vulnerable versions: 16 StubMaker typosquatted gems - WordPress — Compromised WordPress sites hosting ErrTraffic injections
Vulnerable versions: Sites with injected ErrTraffic JavaScript
Remediation for QuoIntelligence Weekly Snapshot W34 2026
Immediate actions
- Block and hunt for the listed domains (github.aoitour.com, debug.allllowef.space, dresslee.com, ErrTraffic domains) and 158.94.208.104 at DNS/proxy/firewall
- Search macOS fleets for /tmp/.com.apple.dt.* payloads, /tmp/.tcc_mod.db, ~/.local/share/.stream and non-Apple LaunchDaemons impersonating crash reporting
- Search Ruby projects and Gemfile.lock for the 16 StubMaker gem names and review extconf.rb execution during installs
- Reset passwords, revoke browser sessions/cookies and rotate crypto wallet seeds for any host where a stealer ran
Workarounds
- Disable the Windows Run dialog via policy for non-admin users to blunt ClickFix
- Block outbound access to public blockchain RPC endpoints from endpoints that have no business need
Longer-term hardening
- Restrict clipboard-to-Run/Terminal paste behavior through user awareness training on ClickFix and fake-terminal-install lures
- Enforce EDR coverage on macOS with alerts on xattr quarantine removal, ad-hoc codesigning and tmutil/mount_apfs snapshot use
- Use private gem mirrors or allow-listing with typosquat detection and disabling native extension build hooks where possible
- Do not engage unsolicited 'recovery' firms during ransomware incidents; route through the incident response and negotiation provider
Timeline of QuoIntelligence Weekly Snapshot W34 2026
- ErrTraffic MaaS first surfaces on Russian-language cybercrime forums (December 2025), advertised by the handle LenAI
- Securonix publishes analysis of ErrTraffic combining EtherHiding and ClickFix, with delivery of Vidar, Stealc, Remus, Salat, SmokeLoader, DanaBot, HijackLoader and GULoader
- WatchGuard publishes ErrTraffic campaign IOCs: compromised WordPress sites, Polygon RPC lookups, and Vidar, Okobot, LegionLoader, OnionDrop and BabaDedaLoader payloads
- Jamf Threat Labs publishes AmnesiaStealer analysis: counterfeit GitHub page github.aoitour.com delivering a multi-stage Rust macOS infostealer
- OpenSourceMalware (Paul McCarty) discovers the StubMaker campaign of 16 typosquatted RubyGems packages dropping a Go-based Windows stealer
- BleepingComputer reports GuidePoint GRIT findings that Ransom Busters is likely a rogue ransomware affiliate posing as a recovery firm, quoting $20,000-$60,000 for data deletion and decryption
- QuoIntelligence publishes Threat Intelligence Snapshot Week 34 2026 covering AmnesiaStealer, ErrTraffic, malicious RubyGems packages and Ransom Busters
Sources cited for QuoIntelligence Weekly Snapshot W34 2026
- Threat Intelligence Snapshot: Week 34, 2026 (QuoIntelligence)
- AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers (Jamf Threat Labs)
- AmnesiaStealer Gives Attackers Live Control of Victims' macOS Browsers (Security Affairs)
- EtherHiding meets ClickFix in the ErrTraffic MaaS framework (Securonix)
- ErrTraffic Malware Campaign: ClickFix and EtherHiding (WatchGuard)
- 16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets (The Hacker News)
- Rogue ransomware affiliate 'Ransom Busters' poses as recovery firm (BleepingComputer)
Detection coverage for TL-2026-3618
As of 2026-10-15, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-3618 across Splunk SPL, Microsoft KQL and Sigma, covering 29 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.
Community OSINT corroboration for TL-2026-3618
2 of this threat's indicators have also been reported by the open-source security community. Community sightings are unverified and are kept separate from Threadlinqs' curated indicators. Indicator values, reporters and campaign linkage are available to authenticated Red-tier users.