Atomic MacOS (AMOS) stealer infection, (Sun, Aug 2nd)

Introduction This diary provides indicators from an Atomic MacOS (AMOS) stealer infection that I generated in my lab on July 31st, 2026. This was distributed through a web page from getmacouscloud[.]com with instructions to paste text into a macOS Terminal window, supposedly for "macOS toolkit," but instead the text is a command to retrieve and install AMOS stealer malware. Of note, I ran the text in the Terminal window twice, because I wanted to make sure I retrieved copies of files in the hos