AMOS with a hidden boot backdoor

Summary

The third execution path, running from the end of January 2026, which Microsoft attributes to AMOS. The pasted instruction decoded and decompressed a first-stage script, which retrieved a Mach-O binary into a temporary folder named helper, or from February one named update. An AppleScript stager hid its strings by array subtraction and read system_profiler for hypervisor names and generic hardware strings, quitting where the machine looked like an analysis box. The stealer then asked for the macOS password, verified it, and copied Keychain databases, Chromium browser credentials, cookies and autofill, plus extension and desktop wallet data, into an archive posted to a /contact endpoint. Ledger and Trezor applications were replaced with operator copies. A hidden backdoor binary and a small wrapper that restarts it were left in the home directory and loaded at boot by a LaunchDaemon named after Finder.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).

Indicators

43 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.