Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.
- Delivered via fake 'macOS toolkit' page getmacouscloud[.]com; command retrieves a Zsh script from ferncore13[.]com.
- Installer drops payloads disguised as accountsd and metadata service files in Application Support.
- Exfiltrates browser credentials, wallets (Binance, TonKeeper), Telegram data, and FileGrabber content to C2 161.35.146[.]120.
- AMOS advertised on Telegram since April 2024; distributed via ClickFix campaigns, malicious ads, and cracked-software sites.
- ATT&CK
- T1059.004 Unix ShellT1555.003 Credentials from Web BrowsersT1552.001 Credentials In FilesT1041 Exfiltration Over C2 Channel
- Vendors
- Palo Alto Unit 42
- Malware
- AMOS Stealer
- Organizations
- Palo Alto Unit 42
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| domain | ferncore13.com | in Figure 2 retrieved a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f9 |
| domain | getmacouscloud.com | ng to have installation instructions for a macOS toolkit is getmacouscloud[.]com . An example of one of the pages is shown below in Figure |
| domain | grove-89.com | m the payload returned from the initial download: hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted hxxps[:]//ferncore13[.]com/2 |
| ipv4 | 161.35.146.120 | HTTP POST requests to a command and control (C2) server at 161.35.146[.]120 . Figure 9 shows traffic from the infection filtered in W |
| ipv4 | 188.166.78.138 | ler infection generated traffic to a different C2 server at 188.166.78[.]138 . This comparison underscores a notable characteristic of |
| sha256 | 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 | fection persistent on the infected macOS host SHA-256 hash: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 File size: 568,368 bytes File location: /Users/[username]/L |
| sha256 | 608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 | a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 . That Zsh script contains Base64-encoded text for a GZIP-c |
| sha256 | 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 | fection persistent on the infected macOS host SHA-256 hash: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 File size: 438,576 bytes File location: /Users/[username]/L |
| sha256 | 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c | a command run from the macOS Terminal window SHA-256 hash: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c File size: 1,991 bytes File type: Zsh script text executabl |
| sha256 | 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a | cted from the initially downloaded Zsh script SHA-256 hash: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a File size: 1,213 bytes File type: Zsh script text executabl |
| sha256 | a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 | y long lines (323) Installer for AMOS stealer SHA-256 hash: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 File size: 330,768 bytes File location: /tmp/helper File ty |
| url | https://ferncore13.com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update | load: hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update Additional Resources 2026-06-09: Atomic macOS (AMOS) St |
| url | https://ferncore13.com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 | e command in Figure 2 retrieved a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688 . That Zsh script contains Base64-encoded text for a GZ |
| url | https://getmacouscloud.com | with instructions that will infect a vulnerable macOS host: hxxps[:]//getmacouscloud[.]com URL for the initial download decoded from Base64 text p |
| url | https://grove-89.com/api/metrics/run?event=pasted | racted from the payload returned from the initial download: hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRd |
From the original article
6 min read at unit42.paloaltonetworks.com
Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.
By Bradley Duncan · unit42.paloaltonetworks.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.