# QuoIntelligence Weekly Snapshot W34 2026: AmnesiaStealer (macOS), ErrTraffic MaaS, Malicious RubyGems Packages (StubMaker), Ransom Busters

> QuoIntelligence's Week 34 2026 snapshot highlights four financially motivated threats: the AmnesiaStealer macOS infostealer spread via a counterfeit GitHub page, the ErrTraffic MaaS combining EtherHiding and ClickFix, typosquatted RubyGems packages stealing browser credentials and crypto wallets, and Ransom Busters, a rogue ransomware affiliate posing as a recovery firm.

- **Published:** 2026-10-15T13:01:12Z
- **Last reviewed:** 2026-10-15T13:01:12Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-3618
- **ID:** TL-2026-3618
- **Severity:** MEDIUM
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 29 (full data via the Threadlinqs MCP server — Purple tier)

## Description

This record consolidates the four malware/fraud items named in QuoIntelligence's Threat Intelligence Snapshot for Week 34 2026 (published 2026-08-21; the public page lists headlines only), enriched from primary vendor reporting.

AmnesiaStealer (Jamf Threat Labs, 2026-08-13): a multi-stage, Rust-based macOS infostealer distributed through a counterfeit GitHub download page (github.aoitour.com) that instructs the victim to paste a base64-encoded command into Terminal and enter their device password. Stage 1 is a Mach-O dropper/stealer that shows a fake macOS login prompt to capture the user password, validates it (dscl), unlocks the Keychain, and harvests Chromium-browser data (Chrome, Brave, Arc, Edge, Opera, Vivaldi, Chromium), Safari cookies, Apple Notes and Telegram data, staging in /tmp and archiving with ditto. It removes quarantine attributes, ad-hoc signs itself, abuses mounted Time Machine/APFS snapshots to read TCC-protected data and modifies a copy of the TCC database, and persists through a LaunchDaemon masquerading as Apple crash reporting. Tasking is polled over an HTTP API (/api/bot/join, /api/bot/actions, /send/) against an 'Amnesia Panel' backend. Stage 2 (stream_module) uses Chrome DevTools Protocol and a WebSocket relay to give the operator live, hidden control of the victim's cloned browser profile (navigate, mouse_click, export_cookies, tabs).

ErrTraffic (Securonix 2026-06-17; WatchGuard 2026-08-10): a Malware-as-a-Service traffic distribution framework first advertised on Russian-language cybercrime forums in December 2025 by the handle LenAI, with 2026 pricing of roughly $300-$380 per month and $1,500-$4,500 for source code. It injects ClickFix lures (fake browser/CAPTCHA glitches that copy a PowerShell command to the clipboard via navigator.clipboard.writeText and prompt the victim to run it via Win+R) into compromised WordPress sites, and resolves its C2/payload domains dynamically through EtherHiding: smart contracts on Polygon and BNB Smart Chain queried read-only with eth_call (via Polygon RPC providers such as Quicknode) act as dead drop resolvers, with C2 rotation about daily. Delivered families include Vidar, Stealc, Remus, Salat, SmokeLoader, DanaBot, HijackLoader, GULoader, Okobot, LegionLoader, OnionDrop, BabaDedaLoader and a NodeJS backdoor using gRPC over Tor. Tradecraft includes payload URLs of the form api/index.php?a=dl&token=<64 chars>, DLL side-loading through legitimate executables, remote-thread injection into Chrome/Edge, rundll32 ordinal-export execution, and 120+ MB archives to evade sandbox size limits. The framework sets an errtraffic_session cookie, which is a useful identification pivot.

Malicious RubyGems packages (StubMaker, reported via OpenSourceMalware / The Hacker News, discovery 2026-08-15): 16 typosquatted gems (e.g. ubnuler, ubnlder, ri18nr, reaker, rakier, orakw, joxn, ise18n, ioe18n, ie18u, iai8n, i1l8n, i18om, activesupmport, brumdler, brundlef) published under throwaway accounts in a two-day sequential pattern. An extconf.rb hook runs at gem install time, fetches a 22 MB Rust loader which unpacks a Go-based stealer ('wincfg') that steals Chromium-browser credentials, cookies and extensions, payment cards, cryptocurrency wallets and seed phrases, Telegram Desktop data and system information on Windows, geolocates the host via api.ipify.org, contacts dresslee.com, and exfiltrates password-protected ZIPs to Gofile.

Ransom Busters (GuidePoint Security GRIT, reported by BleepingComputer 2026-08-19): an entity contacting ransomware victims, sometimes before an incident became public, offering decryption keys and stolen-data deletion for $20,000-$60,000 for incidents involving DragonForce, Settra and Anubis. GRIT assesses with moderate confidence that it is a single rogue ransomware affiliate abusing insider/RaaS-panel access to divert payments. Overlapping forensic artifacts across incidents: SoftPerfect Network Scanner, s5cmd, the Remotely remote-monitoring tool, a local backdoor account with password 'Numlock!123' and attacker hostname DESKTOP-BBETH6K. No victim payments to Ransom Busters were confirmed.

No CVE, CVSS score or KEV entry is associated with these items; severity is a conservative MEDIUM. Attribution of the individual items is not established beyond the ErrTraffic seller handle (LenAI) and GRIT's affiliate assessment. The snapshot also covers geopolitical items that are out of scope for this record.

## MITRE ATT&CK

- T1195.001 Compromise Software Dependencies and Development Tools
- T1204.004 User Execution: Malicious Copy and Paste
- T1059.004 Command and Scripting Interpreter: Unix Shell
- T1059.001 Command and Scripting Interpreter: PowerShell
- T1543.004 Create or Modify System Process: Launch Daemon
- T1553.001 Subvert Trust Controls: Gatekeeper Bypass
- T1036 Masquerading
- T1218.011 System Binary Proxy Execution: Rundll32
- T1574.001 DLL
- T1555.003 Credentials from Password Stores: Credentials from Web Browsers
- T1555.001 Credentials from Password Stores: Keychain
- T1056.002 Input Capture: GUI Input Capture
- T1539 Steal Web Session Cookie
- T1005 Data from Local System
- T1568 Dynamic Resolution
- T1219 Remote Access Tools
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Threat Intelligence Snapshot: Week 34, 2026 (QuoIntelligence)](https://quointelligence.eu/2026/08/threat-intelligence-snapshot-week-34-2026/)
- [AmnesiaStealer: a multi-stage Rust-based macOS infostealer that hijacks Chromium browsers (Jamf Threat Labs)](https://www.jamf.com/blog/amnesia-stealer-macos-infostealer-clickfix/)
- [AmnesiaStealer Gives Attackers Live Control of Victims' macOS Browsers (Security Affairs)](https://securityaffairs.com/197190/malware/amnesiastealer-gives-attackers-live-control-of-victims-macos-browsers.html)
- [EtherHiding meets ClickFix in the ErrTraffic MaaS framework (Securonix)](https://connect.securonix.com/threat-research-intelligence-62/etherhiding-meets-clickfix-in-the-errtraffic-maas-framework-379)
- [ErrTraffic Malware Campaign: ClickFix and EtherHiding (WatchGuard)](https://www.watchguard.com/br/wgrd-security-hub/secplicity-blog/errtraffic-malware-campaign-clickfix-and-etherhiding)
- [16 Typosquatted RubyGems Packages Steal Browser Credentials and Crypto Wallets (The Hacker News)](https://thehackernews.com/2026/08/16-typosquatted-rubygems-packages-steal.html)
- [Rogue ransomware affiliate 'Ransom Busters' poses as recovery firm (BleepingComputer)](https://bleepingcomputer.com/news/security/rogue-ransomware-affiliate-ransom-busters-poses-as-recovery-firm)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-3618