Overview

• The AMOS-family variant, dubbed Shamos, harvests Keychain items, Apple Notes, browser data and cryptocurrency wallets, then zips and exfiltrates the files using curl.
• Distribution relies on malvertising and ClickFix pages or fake GitHub repositories that instruct users to paste a single command, which downloads a Bash script and the Mach-O payload.
• The script removes Gatekeeper quarantine with xattr and chmod, captures the user’s password, performs anti-VM checks and conducts host reconnaissance via AppleScript.
• When run with sudo, Shamos creates a LaunchDaemons plist named com.finder.helper.plist for persistence and can pull additional payloads, including a spoofed Ledger Live app and a botnet module.
• CrowdStrike observed global targeting and evidence of an impersonated Australia-based electronics retailer in Google Ads, with ads intentionally not served to Russian users.