2026-09-10 (THURSDAY): ATOMIC MACOS (AMOS) STEALER INFECTION

NOTICE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

NOTES:

• My thanks to Dani [Varys] Z who let me know abut the fake macOS software page through a comment on LinkedIn.

ASSOCIATED FILES:

• 2026-09-10-AMOS-Stealer-notes.txt.zip   1.9 kB   (1,884 bytes)
• 2026-09-10-AMOS-Stealer-infection-traffic.pcap.zip   3.5 MB   (3,476,742 bytes)
• 2026-09-10-files-from-AMOS-Stealer-infection.zip   838.7 kB   (838,718 bytes)

 

IMAGES

Shown above: Fake macOS software page.

 

Shown above: Text from the fake software page pasted into a macOS Terminal window.

 

Shown above: Traffic from the infection filtered in Wireshark.

 

Click here to return to the main page.