AMOS behind a fingerprint gate

Summary

Microsoft Threat Intelligence tracked a cluster of more than 250 look-alike download domains distributing macOS information stealers, among them MacSync and Atomic Stealer. Many names come from a generator pairing the token "file" with two dictionary words, across .com, .sbs and .online, though some place it elsewhere or omit it. Early pages handed the paste-into-Terminal instruction to any visitor; the operators later put a small JavaScript profiler in front, reading navigator, screen and WebGL values, timezone, iframe and touch state, plus tripwires for an open developer console and hooked prototypes, then posting the result back for a server-side ruling. Requests that fail receive a blank shell, a bogus VPN-extension page or an unrelated business site, so a benign answer proves little. Those that pass see a forged Verified Publisher badge, spoofed GitHub styling and a one-click Terminal command ending in Atomic Stealer.

Execution mechanisms

The only execution mechanism any published account describes for this campaign is Terminal paste (macOS) (T1059.004), which 8 of the 44 published campaigns in this corpus also record (18%).

Indicators

17 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator. No observation date is recorded for any of them.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.