Amos

AMOS is a malicious software (malware) that targets Mac systems, with the ability to steal passwords, personal files, and cryptocurrency wallet information. It was first identified as part of the ClearFake campaign, which aimed to spread the macOS AMOS information stealer. The malware can infect both Intel and Apple M1 Macs, indicating a broad vulnerability among users. Once installed, typically through deceptive downloads offered on various project webpages, it acts as an "infostealer," compromising user data and operations. The threat actor known as “markopolo” has been identified as a significant operator in the distribution of AMOS, using a purported virtual meeting software called Vortax to deliver three potent information stealers—Rhadamanthys, Stealc, and Atomic macOS Stealer (AMOS). This campaign has far-reaching implications for macOS security, suggesting a potential surge in AMOS attacks. Research indicates that other operators of AMOS will likely model future campaigns after markopolo's success, potentially leading to a wider proliferation of AMOS in the wild. Tools such as Recorded Future Identity Intelligence and Brand Intelligence provide insights into compromised credentials from AMOS infostealer logs, database breaches, and combo lists. These tools, combined with Recorded Future Network Intelligence, help identify malicious domains and IP addresses associated with AMOS builds. Clients can use Recorded Future Malware Intelligence to identify and mitigate threats from malicious macOS applications, analyzing connections to AMOS C2 infrastructure. A previous report by Insikt Group observed a 79% increase in mentions of macOS malware and exploit kits between 2022 and 2023, a trend likely accelerated by the increased use of the AMOS infostealer.