Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
45
Vendor
Palo Alto Unit 42
- Mentions · 7d0
- Mentions · 30d0
- All mentions5
- First seenAug 17, 2026
- Last mentionedSep 16, 2026
Timeline
5 articles · newest firstIdentity Abuse Through Trusted Communication Channels
Unit 42 explains how attackers abuse trusted enterprise communication and collaboration channels for identity phishing and credential theft, and outlines defenses.
35
Patchwork Continues to Deliver BADNEWS to the Indian Subcontinent
Unit 42 details Patchwork APT campaigns against the Indian subcontinent using EPS exploits and an updated BADNEWS backdoor targeting Pakistani military and nuclear interests.
54
RANCOR: Targeted Attacks in South East Asia Using PLAINTEE and DDKONG Malware Families
Unit 42 names RANCOR, a previously unidentified espionage group targeting Southeast Asian political entities with newly discovered PLAINTEE and DDKONG malware families.
56
Upatre Continued to Evolve with new Anti
Unit 42 analyzes an undocumented Upatre downloader variant with VM detection via process hashing, packed code, disabled Windows defenses and Namecoin .bit C2 domains.
28
Related CVEs
by mentions- CVE-2017-026178%7.8Use-After-Free RCE in Microsoft Office 2010/2013/2016
- CVE-2015-254586%—Malformed EPS Image RCE in Microsoft Office
Appears with
- Upatreproduct · 1
- Patchworkthreat actor · 1
- Binanceproduct · 1
- TonKeeperproduct · 1
- AMOS Stealermalware · 1
- DDKONGproduct · 1
- DDKONGmalware · 1
- RANCORthreat actor · 1
- Lockymalware · 1
- BADNEWSproduct · 1
- PLAINTEEproduct · 1
- BADNEWSmalware · 1
- Palo Alto Unit 42organization · 1
- Monsoonthreat actor · 1
- OpenNICorganization · 1
- GameOver Zeusmalware · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.