This is a classic AMOS campaign targeting macOS users via malvertising or fake browser updates.
The infection chain starts with a signed (or ad-hoc signed) Mach-O binary masquerading as a legitimate installer. Once executed, the stealer harvests Keychain data, browser cookies, cryptocurrency wallets, and iCloud Keychain passwords.
Technical Breakdown: – Initial Access (T1566.002): Drive-by download from typosquatted domains mimicking Google Chrome or Brave update pages. – Persistence (T1547.001): LaunchAgent plist written to ~/Library/LaunchAgents/com.apple.softwareupdate.plist. – Credential Access (T1555.001): Direct Keychain dump via security dump-keychain and browser SQLite extraction. – Exfiltration (T1041): Base64-encoded ZIP archive POSTed to C2 over HTTPS. C2 domains observed: cdn-update[.]cloud, api-verify[.]services. – IOCs: – SHA256: a3f1c8e2b7d9... (sample from this campaign) – Domains: cdn-update[.]cloud, api-verify[.]services – Path: ~/Library/Application Support/AMOS/
Defense: Block the C2 domains at the DNS level. Enable macOS Gatekeeper and XProtect. Monitor for security dump-keychain execution by non-system processes. Restrict LaunchAgent creation to signed, known-good developers via MDM policy.
Source: https://www.malware-traffic-analysis.net/2026/09/10/index.html
Source: r/SecOpsDaily · by /u/falconupkid