AMOS via a shared delivery layer

Summary

One delivery layer sits behind a range of unrelated lure pages aimed at Mac users. A request to a PHP script named kusaka on any of twenty hosts returns a redirect in the Location header, and only the second request, to a long hashed path on the same host, hands over the disk image. Sekoia has tracked the pattern since May 2024 and reads the arrangement as rented rather than owned: one endpoint fielded traffic from many different front ends, which points to a central crew supplying both the delivery chain and the stealer to affiliates. The publisher also treats the gate as a filter against scanners and bots. Nothing in the report says whether these twenty domains were registered by the operators or belong to sites that were broken into, so none is recorded here as attacker property.

Overlap with other campaigns

We compared the 20 indicators in this record — covering 20 distinct registrable domains — against the 43 other published campaigns in this corpus.

• Google Meet clones, three stealers

  2026-08-07

  1 of the 20 indicators in AMOS via a shared delivery layer also appear in this campaign.

  Shared registrable domain (1)

  • carolinejuskus[.]comdomain, shown defanged for safety: carolinejuskus dot com

A shared indicator is the same record cited by both campaigns. A shared registrable domain is weaker evidence and is counted separately, because two campaigns can share a registrable simply by renting subdomains from the same platform.

Indicators

20 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.