Plan
active
Atomic macOS Stealer (AMOS) Uses Fake Setup Guides to Steal Credentials
- Engineer — Learn: AMOS targets macOS endpoints via social engineering, not a vulnerability in software you patch — review whether your macOS fleet enforces Gatekeeper and restricts unsigned app installs.
- SOC/IR — Plan: Unit 42’s analysis maps AMOS TTPs worth building detections for; queue a review of EDR telemetry for suspicious macOS credential-access patterns and staged data exfiltration consistent with this stealer.
- Leader — Skip
This entry was curated and judged by AI (Claude) with automated enrichment
(CISA KEV / EPSS / public PoC). Verify against the original source before
acting. Found a bad verdict?
Report it —
confirmed errors go to the corrections log.