Security 1 publisher2 min readPublished September 16, 2026 at 5:39 AM PDT

A fake macOS toolkit page plants two AMOS payloads in hidden Library folders

Unit 42 followed the copy-paste instructions on Aug. 5, 2026, and watched one Zsh command install AMOS twice over and package a lab Mac's wallet folders and cloud credentials into a single zip.

The Watch · Security desk

Illustration accompanying A fake macOS toolkit page plants two AMOS payloads in hidden Library folders

What happened

Unit 42 ran an AMOS stealer infection in its lab on Aug. 5, 2026, starting from a page that offered instructions for installing what it called a macOS toolkit.
The command pasted into Terminal pulled a Zsh script from ferncore13[.]com that carried a Base64-encoded, GZIP-compressed payload.
That payload unpacked a second Zsh script, which fetched and ran a Mach-O installer saved as /tmp/helper alongside a plist file named starter.
The Terminal process then asked for control of Finder, control of Notes, and access to files in the user's Desktop and Documents folders.
Unit 42 says AMOS takes system information, login credentials and other sensitive data from applications including web browsers and cryptocurrency wallets.

Compiled by The WatchSomething wrong?How this is made

Why it matters

exposure The weak point is a Mac whose everyday user holds administrative rights, so the fix is an account-privilege decision rather than a patch cycle.
decision One AMOS hit on an engineer's laptop forces a call on rotating AWS and Google Cloud keys before anyone has finished counting the wallet files.
constraint Blocking the two August domains buys days. Anything durable has to key on file paths and process behaviour, because Unit 42 says the indicator set rotates.
contradiction Unit 42 declines to file this cracked-software lure under ClickFix, which matters to anyone sizing ClickFix volume from vendor telemetry: the same copy-paste behaviour is being counted in two different buckets.

The payload lands twice. One shell script and Mach-O pair sits in the hidden .com.apple.accountsd directory under the user's Application Support folder, as .service and AccountsHelper ^[11]. A second pair sits in .com.apple.metadata.mds, as .mdworker and mdworker_shared ^[12]. Both directory names imitate real Apple services, and both launcher scripts are dot-prefixed. Delete AccountsHelper and mdworker_shared keeps running ^[3].

What the stealer collected was staged under /tmp and compressed into a file named out.zip ^[15]. Of the seven paths Unit 42 lists inside that archive, four are credential stores for cloud and developer tooling: aws, docker, filezilla and gcloud ^[2]. Two are desktop wallet directories, Binance and TonKeeper, and the seventh is the user's zsh_history ^[15]. Shell history sitting next to an aws configuration directory tells whoever receives the zip which accounts the keys belong to and what they were last used for.

No CVE appears anywhere in this chain. Every gate is a consent dialog answered by the person at the keyboard, and the lab account had administrative rights ^[13].

AMOS was advertised on Telegram as early as April 2024, which puts about 28 months between the first ad Unit 42 cites and this sample ^[1]^[1]. Unit 42 describes it as a noticeable portion of macOS stealer-based malware and a growing threat ^[2].

getmacouscloud[.]com and ferncore13[.]com are early-August artefacts, and Unit 42 states at the top of the write-up that AMOS indicators constantly change and that what it published is a snapshot ^[6]^[9]^[16]. A blocklist built from those two domains ages out fast. The article does not publish detection rules. It does lay out a sequence a fleet can be queried for: Terminal spawning curl to an unfamiliar host, a Mach-O written to /tmp, a plist there named starter, and a new hidden directory under Application Support carrying an Apple-looking name ^[9]^[10]^[11].

Unit 42 also separates this lure from ClickFix. The page offered quick setup instructions for a cracked macOS toolkit, and the researchers wrote that "this is not really ClickFix", reserving that label for fake CAPTCHA and verification pages that inject a script into the visitor's clipboard for pasting into a Run or Terminal window ^[7]^[8]. AMOS has also arrived through actual ClickFix campaigns and through malicious ads, according to Unit 42 ^[4].

What to watch

Replacement lure domains for getmacouscloud[.]com and ferncore13[.]com, which is what any blocklist built on the August set depends on.
Whether the persistence directory names shift away from .com.apple.accountsd and .com.apple.metadata.mds, breaking file-path hunts.
Whether AMOS operators find a path that installs without the administrative password prompt.

Claim ledger

Ranked by verification strength, evidence, and original report placement.

[15]
AMOS stealer collected and temporarily saved information under the host's /tmp directory and compressed the data into a file named out.zip; the paths Unit 42 lists inside it are deskwallets/Binance/, deskwallets/TonKeeper/, FileGrabber/aws/, FileGrabber/docker/, FileGrabber/filezilla/, FileGrabber/gcloud/ and FileGrabber/zsh_history.
ReportedSupported2 sources— sign in to open View cited source
[1]
AMOS stealer is an information stealer targeting macOS systems that was advertised on Telegram as early as April 2024.
ReportedSupportedView cited source
[2]
Unit 42 says AMOS stealer represents a noticeable portion of macOS stealer-based malware and is considered a growing threat.
ReportedSupportedSource: Unit 42View cited source
[3]
AMOS stealer exfiltrates system information, login credentials and other sensitive data from various applications, including web browsers and cryptocurrency wallets.
ReportedSupportedView cited source
[4]
Unit 42 has seen malware it assessed as AMOS stealer distributed through ClickFix campaigns, through malicious ads, and through campaigns claiming to offer cracked versions of popular copyright-protected software.
ReportedSupportedView cited source
[5]
Unit 42 examined an AMOS stealer infection generated in a lab environment on Aug. 5, 2026, from an instructional page claiming to install a "macOS toolkit".
ReportedSupportedView cited source
[6]
The domain hosting the malicious page with the claimed macOS toolkit installation instructions is getmacouscloud[.]com.
ReportedSupportedView cited source
[7]
"this is not really ClickFix"
ReportedSupportedSource: Unit 42, on the page's quick setup instructionsView cited source
[8]
Unit 42 says the ClickFix technique generally uses a fake CAPTCHA or other verification page, and that ClickFix campaigns inject a script into a viewer's clipboard to paste into a Run window on Windows or a Terminal window on macOS.
ReportedSupportedView cited source
[9]
The command pasted into Terminal retrieved a Z-shell script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688, and that script contained Base64-encoded text for a GZIP-compressed payload.
ReportedSupportedView cited source
[10]
The GZIP-compressed payload contained a follow-up Zsh script that retrieved and ran a Mach-O binary to install AMOS stealer; the installer binary was saved as /tmp/helper, and the same directory contained a plist file named starter.
ReportedSupportedView cited source
[11]
The plist at /tmp/starter hints at a newly created file named .service in the user's /Library/Application Support/.com.apple.accountsd/ directory; .service is a shell script that runs an AMOS stealer Mach-O file named AccountsHelper in the same directory.
ReportedSupportedView cited source
[12]
Unit 42 found an additional directory, the user's /Library/Application Support/.com.apple.metadata.mds/, containing a shell script named .mdworker that runs another AMOS stealer Mach-O file named mdworker_shared.
ReportedSupportedView cited source
[13]
Before the infection would proceed, the macOS host prompted for the user's password; the account on the lab host was an administrative account, and the infection proceeded when the password was entered.
ReportedSupportedView cited source
[14]
After the initial malicious text ran, the Terminal process requested access to control the macOS Finder application, access to files in the user's Desktop folder, access to files in the user's Documents folder, and access to control the macOS Notes application.
ReportedSupportedView cited source
[16]
Unit 42 says the indicators associated with AMOS stealer constantly change, and that its article presents a snapshot of indicators seen in early August 2026.
ReportedSupportedView cited source
[d2]
Four of the seven paths Unit 42 lists inside out.zip are credential or configuration stores for cloud and developer tooling (aws, docker, filezilla, gcloud); two are desktop cryptocurrency wallet directories and one is shell history.
DerivedSupported2 sources— sign in to open
[d1]
About 28 months separate the earliest AMOS Telegram advertisement Unit 42 cites and the lab infection it walks through.
DerivedSupported1 source— sign in to open
[d3]
Two separate AMOS Mach-O files persist in two separate hidden directories, so removing one leaves the other in place.
DerivedSupported1 source— sign in to open

Sources

Publishers with included, body-backed reporting in this cluster.

unit42.paloaltonetworks.com
1 article · September 16, 2026
Atomic macOS (AMOS) Stealer Activity

Ask Clarity

Have a question this piece left open? The answer comes from its reporting and claim ledger — nothing else.

Try

Clarity analysis

How the coverage leans and what the record actually supports. Read the methodology

Perspective Coverage

How much of the coverage speaks to builders, operators and investors. It measures emphasis, not whether the story is right.

The part a developer should read is a file listing. On a Mac that was a clean install with no extra applications, AMOS still went looking for FileGrabber/aws/, FileGrabber/docker/, FileGrabber/gcloud/ and FileGrabber/filezilla/, and copied zsh_history. Those are the credentials a laptop uses to reach production, and the shell history that names the hosts they reach. Unit 42 lists them without comment and moves on to network traffic; the post has no advice on rotating what was taken.

Reality

Evidence, adoption, hype gap, incentives and confidence, each read independently from the current record on the scale shown beneath it. How these are measured.

Evidence70

0100

One lab notebook, well kept, unreplicated

Unit 42 documents what it did in the order it did it, with artifacts a reader can match against a host: the script URL, /tmp/helper and /tmp/starter, both hidden directories and their four filenames, the permission prompts, the out.zip listing, the C2 address. The detail is checkable against a controlled infection the authors created themselves. It is also the only account, and Unit 42 warns that the filenames, hashes and paths change often, so the specifics stop being verifiable soon after publication.

Adoption30

0100

Two lab runs, live infrastructure, no counts

Observed activity comes to two infections Unit 42 generated five days apart, plus the infrastructure behind them: a script host, and a C2 that moved from 188.166.78[.]138 on July 31 to 161.35.146[.]120 on Aug. 5. Rotating servers and a rewritten toolchain point to something in active use. How widely it is landing on real Macs is not measured anywhere in this reporting, which stops at calling AMOS a noticeable portion of macOS stealer malware.

Hype gap−10

−100 understated0 aligned+100 overstated

Findings undersold by their own author

The loudest phrase in the post is 'growing threat'. The concrete result gets flatter treatment than it deserves: one pasted line installs two independent copies of the stealer, and a Mac with no extra software installed still yields aws, docker, gcloud and filezilla directories in the zip. Unit 42 also declines the ClickFix label that would have made the post easier to circulate, writing that 'this is not really ClickFix'.

Incentives40

0100

Vendor lab publishing its own casework

Unit 42 is Palo Alto Networks' threat research group, and posts like this feed the detection content and reputation the company sells on. No product is named, no customer is quoted and nothing links to a purchase path, so the pull is indirect. The choice of what to show is still the vendor's: a lab infection it created, on a host it configured, with the cleanup and prevention questions left out.

Confidence62

0100

First-party and detailed, single-sourced and perishable

Confidence rests on the mechanics, which are specific enough to check against a host, and on the author telling readers where the account stops. It is held down by having one publisher, one lab environment, an admitted expiry date on the indicators, and the fact that only Palo Alto Networks has confirmed the Aug. 5 chain so far.

Topics and entities

Follow any of these and your For You feed starts watching them — no settings page required.

Topics

Entities

security
Aeternum puts botnet C2 on Polygon, and leaves defenders no domain to seize
1 publisher
product
Fake Codex installer outranks OpenAI in Google ads, then asks for a paste
1 publisher
science
TeamPCP hid its infostealer inside the scanners that audit everyone else's code
1 publisher
product
Cloudflare turns OpenAI's cyber model into WAF rules that wait on human approval
1 publisher

What happened

Why it matters

What to watch

Claim ledger

Sources

Let Clarity write the post for you.

Topics and entities

Topics

Entities

Related stories

Claim ledger

Sources

Let Clarity write the post for you.

Perspective Coverage

Reality

Topics and entities

Topics

Entities

Related stories