Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
45
Product
Binance
- Mentions · 7d0
- Mentions · 30d0
- All mentions3
- First seenSep 7, 2026
- Last mentionedSep 16, 2026
Timeline
3 articles · newest firstJSCeal Hides Crypto Malware in V8 Bytecode
Check Point details JSCeal, a crypto-stealing malware delivered as compiled V8 bytecode, and built a decompiler pipeline to expose its capabilities.
58
JSCeal Malware Can Bypass Google Authentication Using Stolen Session Cookies
Check Point details JSCeal, a V8-compiled JavaScript stealer that replays stolen cookies to bypass Google authentication, spread via crypto malvertising.
45
Appears with
- Bybitproduct · 2
- Ledgerproduct · 2
- JSCealmalware · 2
- WEEVILPROXYthreat actor · 1
- Lunoproduct · 1
- Check Point Researchvendor · 1
- Check Pointvendor · 1
- Confiantvendor · 1
- Check Pointorganization · 1
- Confiantorganization · 1
- FileZillaproduct · 1
- MeadowLocustthreat actor · 1
- GPTai model · 1
- SourTradethreat actor · 1
- Bitdefenderorganization · 1
- Telegramproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.