AMOS via a fake Spectrum page

Summary

Reported publicly in June 2025 by CloudSEK and dated by Microsoft to the closing days of May, this operation pointed Mac owners at delivery pages made up to look like Spectrum, the American cable, broadband and telephone company. The page showed a counterfeit CAPTCHA with an alternate verification button; the steps it then displayed were written for Windows even when the reader was on a Mac, while the command placed on the clipboard differed by platform. On macOS that command asks for the account password again and again until one checks out against directory services, keeps it in the temporary folder, pulls a file down from applemacios[.]com, uses the captured password to strip the quarantine flag, marks the file runnable and starts it. The file belongs to the Atomic Stealer family, whose Poseidon and Odyssey variants take browser cookies, saved passwords and cryptocurrency wallet material.

Cross-vendor timeline

2 published accounts. CloudSEK was first, on 2025-06-04. The most recent is Microsoft Threat Intelligence, 78 days later.

1. 2025-06-04CloudSEK

   AMOS Variant Distributed Via Clickfix In Spectrum-Themed Dynamic Delivery Campaign By Russian Speaking Hackers

2. 2025-08-21Microsoft Threat Intelligence+78 days

   Think before you Click(Fix): Analyzing the ClickFix social engineering technique

Dates are the publishers’ own publication dates as recorded when we retrieved each article. Publication order is not attribution: a later account may be the more complete one.

Overlap with other campaigns

We compared the 12 indicators in this record — covering 7 distinct registrable domains — against the 43 other published campaigns in this corpus.

• Lumma Stealer's PNG stego loader

  2026-08-07

  No indicator is shared, but the two records use the same registrable domains.

  Shared registrable domain (1)

  • pages[.]devdomain, shown defanged for safety: pages dot dev

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 12

Checks recorded

2

Checks since publication

2

Never checked

11

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 11 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

No other campaign on record combines them. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

12 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.