"AMOS stealer is an information stealer targeting macOS systems that was advertised on Telegram as early as April 2024," Palo Alto Networks Unit 42 reported in a lab review of an early August 2026 infection. The finding is a compact, forensic snapshot — but it shows a clear pattern: copy/paste instructions on a malicious web page lead to a Zsh script that unpacks and installs binaries that quietly harvest credentials, wallets and local data.
How the infection unfolded in the lab
Unit 42 recreated an AMOS stealer infection on Aug. 5, 2026, by following installation instructions on a malicious page hosted at getmacouscloud[.]com. The page presented “quick setup” instructions that the researchers copied and pasted into a macOS Terminal window. The pasted command retrieved a Zsh script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688, which contained Base64-encoded GZIP data. That payload unpacked a follow-up Zsh script that downloaded a Mach-O binary and saved it to /tmp/helper.
Persistence, privileges, and the files left behind
Persistence was achieved through files placed in user Application Support directories and a plist saved to /tmp. The plist at /tmp/starter referenced a newly created shell script named .service in /Library/Application Support/.com.apple.accountsd/ that launches an AMOS Mach-O file named AccountsHelper. A parallel directory, /Library/Application Support/.com.apple.metadata.mds/, contained a .mdworker shell script that runs an AMOS binary named mdworker_shared.
The infection required a user-entered password on the macOS host because the lab account was an administrative account; entering the password allowed the process to continue. After initial execution, the Terminal process requested multiple macOS permissions: control of the Finder application and access to files in the Desktop and Documents folders, and control of the Notes application.
Audit-ready is a season. It shouldn't be.
Evidence in spreadsheets, controls drifting between audits, frameworks multiplying on flat headcount. Nubivance runs continuous compliance on Rapid7 Cyber GRC - SOC 2, HIPAA, ISO 27001, PCI, CMMC.
End the scrambleWhat AMOS collected and where it sent it
During the lab run AMOS stealer collected and staged data under /tmp, compressing results into a file named out.zip. The archive structure included directories and files that indicate the stealer searched for cryptocurrency wallets, cloud and developer credentials, and local app data:
- deskwallets/Binance/
- deskwallets/TonKeeper/
- FileGrabber/aws/
- FileGrabber/docker/
- FileGrabber/filezilla/
- FileGrabber/gcloud/
- FileGrabber/zsh_history
- Telegram Data/ and username, info files
Post-infection network activity consisted mainly of HTTP POST requests to a command-and-control (C2) server at 161.35.146[.]120. Initial POST URLs included query strings that reveal staged exfiltration workflows: stage=boot, stage=init_session, stage=messengers, stage=credentials, stage=browsers, stage=wallets, stage=resolve_auth and stage=local_data. Unit 42 compared this run with a July 31, 2026 infection that used a different C2 at 188.166.78[.]138, underscoring frequent infrastructure churn.
Technical indicators recovered in the lab
Unit 42 cataloged five files discovered during the August 5 infection, including hashes and locations that enable detection for that specific snapshot:
- Initial Zsh script (download location hxxps[:]//ferncore13[.]com/...688) — SHA-256: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c — 1,991 bytes
- Extracted payload Zsh script — SHA-256: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a — 1,213 bytes
- Installer saved to /tmp/helper — SHA-256: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9 — 330,768 bytes
- Persistent binary AccountsHelper (/Users/[username]/Library/Application Support/.com.apple.accountsd/) — SHA-256: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620 — 438,576 bytes
- Persistent binary mdworker_shared (/Users/[username]/Library/Application Support/.com.apple.metadata.mds/) — SHA-256: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9 — 568,368 bytes
Additional URLs returned from payloads included hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted and an update path on ferncore13[.]com. The malicious website hosting instructions was hxxps[:]//getmacouscloud[.]com.
What this means for technologists, affected enterprises, and end users
- Technologists and security teams: Monitor for the listed file paths, plist activity under /tmp, and POST traffic patterns that include stage=credentials or stage=wallets. Note that binaries found were universal Mach‑O files (x86_64 and ARM64), and indicators such as domain names and IP addresses can change rapidly.
- Affected enterprises and procurement leaders: The infection vector observed was a user-level copy/paste into Terminal from a web page claiming to provide a macOS toolkit; software distribution channels that host or link to cracked software can be exploited to deliver AMOS. Controls that restrict arbitrary command execution and store of administrator credentials may interrupt this chain.
- End users: The lab infection required typing an administrative password and accepting Terminal-driven permission prompts for Finder, Desktop and Documents access and Notes control. Exercise caution before pasting commands from web pages and when prompted to enter elevated credentials.
Unit 42’s analysis is a pointed reminder: AMOS stealer is a live, evolving family. Domains, filenames, and C2 addresses fluctuate, but the pattern—copy/paste retrieval of scripts, installation of Mach‑O binaries, local data collection and staged POST exfiltration—remains consistent in the samples Unit 42 examined. For defenders, the practical path forward is surveillance for these behaviors and rapid updating of detections as indicators shift.
