ATOMIC MACOS (AMOS) STEALER INFECTION FROM MALICIOUS AD IMPERSONATING CLAUDE CODE

6.10.26  MALWARE TRAFFICS 

NOTICE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

ASSOCIATED FILES:

• 2026-10-02-IOCs-from-AMOS-Stealer-infection.txt.zip   2.7 kB   (2,569 bytes)

• 2026-10-02-AMOS-Stealer-traffic.pcap.zip   22.8 MB   (22,798,871 bytes)

• 2026-10-02-AMOS-Stealer-files.zip   1.3 MB   (1,256,365 bytes)

Shown above: Malicious ad impersonating Claude Code.

Shown above: Malicoius site impersonating Claude Code.

Shown above: ClickFix style instructions pretending to install Claude Code but actually installing AMOS Stealer.

Shown above: ClickFix style script for AMOS Stealer pasted into a macOS Terminal window.

Shown above: Popup requests for password and permissions requested by AMOS Stealer.