> ## Content Index > Fetch the complete content index at: https://blog.alphahunt.io/llms.txt > Use this file to discover other available public pages before exploring further. # Shamos macOS Infostealer: Malvertising Lures, BYOD Gaps, and Sector Expansion - URL: https://blog.alphahunt.io/shamos-macos-infostealer-malvertising-lures-byod-gaps-and-sector-expansion/ - Published: 2025-09-02T12:00:26.000Z - Updated: 2026-10-23T23:47:33.000Z - Description: Shamos, a new Atomic macOS Stealer (AMOS) variant attributed to COOKIE SPIDER, is targeting U.S. tech and education sectors via malvertising and fake support sites. - Author: Wes - Tags: shamos, macos, ecrime, malvertising, 2025 *Shamos, a new Atomic macOS Stealer (AMOS) variant attributed to COOKIE SPIDER, is targeting U.S. tech and education sectors via malvertising and fake support sites. CrowdStrike telemetry shows 300+ attempted compromises between June–August 2025\. Attackers exploit user trust in search results, persuading victims to run a one-line Terminal command that disables Gatekeeper and installs Shamos, bypassing standard macOS defenses.* --- ## TL;DR - **Enforce**: Block all unsigned binaries/scripts via Gatekeeper and XProtect within 30 days of this notice; minimize false positives to sustain analyst trust. - **Detect**: Load all provided IOCs (domains, representative hashes) into SIEM/EDR/DNS; add new hashes within 24 hours of publication. - **Audit**: Review `/Library/LaunchDaemons/` for unauthorized plists monthly; flag Bash one-liners (T1059.004), credential access (T1555.003), and search-engine-ad phishing (T1566.002). - **Train**: Require ≥90% user completion of Shamos-specific training within 45 days. - **Segment**: Ensure 100% of new BYOD devices pass onboarding checks before network access. --- ## Why it matters ### SOC - Alert on DNS queries to `mac-safer[.]com`, `rescue-mac[.]com`, `icloudservers[.]com` (minimize FPs to sustain analyst trust). - Flag process executions matching representative SHA-256 hashes: `231c4bf14c4145be77aa4fef36c208891d818983c520ba067dda62d3bbbf547f`, `4549e2599de3011973fde61052a55e5cdb770348876abc82de14c2d99575790f` (see full IOC list). - Monitor for new/unauthorized plist files in `/Library/LaunchDaemons/` (T1547.001) and search-engine-ad phishing events (T1566.002). ### IR - Preserve evidence of Terminal command execution and Bash script downloads (T1059.004). - Collect credential access attempts from macOS Keychain (T1555.003). - Isolate affected endpoints, especially unmanaged/BYOD devices. ### SecOps - Enforce Gatekeeper and XProtect via MDM on ≥95% of macOS endpoints. - Block unsigned binaries/scripts with Apple’s Endpoint Security framework or EDR/XDR. - Deploy ad-blockers, DNS filtering, and browser extensions to hide sponsored results. ### Strategic - Prioritize macOS security baselines for tech/education sectors. - Address BYOD and unmanaged device risks in policy and onboarding. - Monitor for targeting expansion beyond tech/education as Shamos/AMOS variants evolve. --- [![CTA Image](https://storage.ghost.io/c/06/e5/06e5730b-7d78-4713-9cec-6cba31d297f5/content/images/2025/08/ah_slack.png)](https://alphahunt.io/?ref=blog.alphahunt.io) Ready to level up your intelligence game? [Sign Up! ](https://alphahunt.io/?ref=blog.alphahunt.io) --- ## The story in 60 seconds Shamos is a macOS infostealer, attributed with moderate confidence to COOKIE SPIDER, distributed via malvertising and fake support sites. Victims searching for Mac troubleshooting help are tricked into running a one-line Terminal command that disables Gatekeeper, downloads a Bash script, and installs the Shamos binary. The malware targets credentials (macOS Keychain, cloud accounts), source code, and research data. CrowdStrike reports 300+ attempted compromises (June–August 2025), with dwell time and credential theft rates still under investigation. BYOD and unmanaged devices in tech and education are especially vulnerable, and no public breach notifications have surfaced to date. ## See it in your telemetry ### Network - DNS queries to `mac-safer[.]com`, `rescue-mac[.]com`, `icloudservers[.]com` (monitor for new domains as IOCs evolve). - Outbound `curl`/HTTP(S) requests to these domains. - Web-protocol exfiltration patterns (T1071.001) from macOS endpoints. ### Endpoint - Bash executions with Base64-decoded payloads (`/bin/bash -c ...`, T1059.004). - Creation/modification of plist files in `/Library/LaunchDaemons/` (T1547.001). - Access attempts to macOS Keychain (T1555.003). - User execution of search-engine-ad phishing payloads (T1566.002). --- ## High Impact, Quick Wins - **SOC**: Load and alert on full Shamos IOC set in SIEM/EDR/DNS; review for search-engine-ad phishing events. - **SecOps**: Enforce Gatekeeper/XProtect and block unsigned scripts on all managed macOS endpoints within 30 days. - **IR**: Preserve evidence of Bash one-liners and credential access attempts for all suspected incidents. --- # Research ## Executive Summary The Shamos macOS infostealer—attributed with moderate confidence to the eCrime group COOKIE SPIDER—is an emerging threat to U.S. technology and education sectors. Delivered through malvertising and fake support sites, Shamos relies on social-engineering lures that persuade victims to run a malicious one-line Terminal command. A variant of the Atomic macOS Stealer (AMOS), it has been reported in more than 300 environments worldwide. This assessment provides key indicators, ATT&CK mappings, and sector-specific mitigations, all linked to primary sources. Where uncertainty remains, it is noted. ## Methodology - Source validation: Only live, primary sources are cited (BleepingComputer, OffSeq Threat Radar, Rewterz); CrowdStrike is referenced second-hand due to access limits. - IOC and TTP collection: Extracted from technical advisories and threat-intelligence reports. - Sector focus: U.S. technology and education. - Mitigations: Anchored in macOS-specific controls and sector policy requirements. ## Findings ### 1\. Evolution, Targeting, and Operational Trends - Shamos is a new AMOS variant offered as malware-as-a-service; campaigns run from June–August 2025. - Victims search for macOS troubleshooting help—primarily in the United States, United Kingdom, and other Western countries; Russian users are excluded per eCrime-forum rules. - High BYOD and remote-support reliance in tech and education increases exposure. ### 2\. Distribution Vectors - Malvertising: Paid ads for fake support domains such as `mac-safer[.]com` and `rescue-mac[.]com`. - Fake support sites: Instruct users to run a Terminal one-liner that decodes a Base64 string, fetches a Bash script from `icloudservers[.]com`, captures the user password, downloads the Mach-O Shamos binary, and disables Gatekeeper. ### 3\. Attribution - COOKIE SPIDER attribution is assessed at moderate confidence. - Infrastructure (malvertising, fake support) and scripting techniques match prior COOKIE SPIDER activity. - Cross-selling on other MaaS markets is possible but unconfirmed. ### 4\. Sector-Specific Risks - **Technology:** Possible theft of source code, cloud credentials, and IP; developers and IT staff are high-risk. - **Education:** Potential compromise of research data, student/faculty credentials, and financial systems; many unmanaged devices and open Wi-Fi networks. - **Common gaps:** Overreliance on web searches for support, limited macOS endpoint controls, and insufficient user training. ### 5\. Indicators of Compromise **Domains** - `mac-safer[.]com` - `rescue-mac[.]com` - `icloudservers[.]com` **Hashes** - MD5: 3b8a6663c3908c523f49264258668a3b - MD5: c7636c37ce1f168078ac3fc3bfcb362c - SHA-256: 231c4bf14c4145be77aa4fef36c208891d818983c520ba067dda62d3bbbf547f - SHA-256: 4549e2599de3011973fde61052a55e5cdb770348876abc82de14c2d99575790f - SHA-1: b670531276b0079b7c80ee8273b4e91c88e3c9e9 - SHA-1: 8d0d65ac91bcdb3f47bdfdef3d7b70e2a3d5164f --- # Recommendations, Actions, and Next Steps 1. **Enforce macOS-Specific Controls to Block Shamos Initial Access and Execution** **Actions** - Enforce Gatekeeper and XProtect via MDM on all managed macOS endpoints. - Disable Safari’s “Open ‘safe’ files after downloading” option to prevent automatic payload execution. - Block unsigned binaries and scripts via the EndpointSecurity API or EDR/XDR. - Audit `/Library/LaunchDaemons/` for unauthorized plist files; Shamos uses this path for persistence (T1547.001). - Require notarization and code-signing for all installations; verify checksums before deployment. **Impact:** Disrupts Shamos TTPs—user-executed Bash one-liners (T1059.004), Gatekeeper bypass (T1562.001), and persistence via Launch Daemons (T1547.001). **Challenges:** Achieving MDM coverage for BYOD/unmanaged devices, user pushback on new restrictions, and integration with existing EDR/XDR. **Metrics** - ≥95% of macOS endpoints enforce Gatekeeper/XProtect within 30 days. - 100% of new installations are notarized and code-signed. - ≤2 unauthorized plist files detected per monthly audit. **Owners/Cadence:** Security Engineering implements controls within 30 days; IT audits LaunchDaemons monthly. **MITRE ATT&CK:** T1059.004, T1562.001, T1547.001, T1204.001 2. **Integrate and Continuously Enrich Shamos-Specific IOCs and TTPs in Detection and Response Workflows** **Actions** - Load the provided IOCs (domains `mac-safer[.]com`, `rescue-mac[.]com`, `icloudservers[.]com`; hashes) into SIEM, EDR, and DNS-filtering solutions. - Automate weekly IOC enrichment using passive DNS, URL patterning, and certificate-reuse analysis. - Validate new indicators to eliminate sinkholes and false positives before distribution. - Maintain a version-controlled IOC repository; distribute updates to SOC tooling. - Configure automated alerts for any access or execution tied to these indicators. - Review logs for Shamos-related activity, emphasizing web-protocol exfiltration (T1071.001) and credential access (T1555.001). **Impact:** Enables rapid detection and containment of Shamos infections and maintains coverage as infrastructure shifts. **Challenges:** Constant IOC churn, potential false positives, and resource demands for enrichment and log review. **Metrics** - Block ≥95% of known Shamos domains within 30 days. - ≤5 false positives per 10,000 DNS queries. - Add new hashes to EDR watchlists within 24 hours of publication. - Complete weekly IOC enrichment and validation on schedule. **Owners/Cadence:** Threat Intel updates/enriches/validates IOCs weekly; Security Operations monitors alerts daily. **MITRE ATT&CK:** T1071.001, T1555.001, T1119, T1005 3. **Targeted User Awareness and Sector-Specific Policy Adjustments** **Actions** - Deliver targeted training that warns against executing Terminal commands from unverified sources, highlighting Shamos’s social-engineering tactics (T1566.001, T1204.001). - Education sector: Segment guest/student networks and require security checks for BYOD devices. - Technology sector: Remove local admin rights from developer endpoints; enforce MFA and least privilege. - Deploy browser extensions that hide sponsored results to reduce malvertising exposure. **Impact:** Lowers the risk of user-driven execution and lateral movement, addressing social-engineering and BYOD threats. **Challenges:** User resistance to privilege reduction, network-segmentation complexity, and consistent adoption of browser extensions. **Metrics** - 100% of new BYOD devices pass onboarding checks before network access. - ≥90% of users complete Shamos-specific training within 45 days. - Remove local admin rights from ≥95% of developer endpoints within 60 days. **Owners/Cadence:** IT/HR track training completion monthly; Network Engineering reviews segmentation quarterly. **MITRE ATT&CK:** T1566.001, T1204.001, T1555.001 --- # Suggested Pivots 1. Query passive DNS for A/AAAA records resolving `mac-safer[.]com`, `rescue-mac[.]com`, and `icloudservers[.]com` from 2025-06-01 to 2025-08-28 against U.S. technology- and education-sector CIDRs. Search EDR and SIEM telemetry for process executions matching SHA-256 hashes `231c4bf14c4145be77aa4fef36c208891d818983c520ba067dda62d3bbbf547f` and `4549e2599de3011973fde61052a55e5cdb770348876abc82de14c2d99575790f` on macOS hosts tagged “EDU\_BYOD” or “TECH\_DEV.” Key fields: `dns.query`, `process.hash.sha256`, `process.command_line`. Success metric: Confirm or refute the existence of more than 300 unique victim environments, using at least two independent data sources (e.g., VirusTotal, Rapid7, internal logs). 2. Cross-reference Shamos TTPs, infrastructure, and victimology with prior AMOS and COOKIE SPIDER campaigns via technical repositories (e.g., VirusTotal Collections, Rewterz, CrowdStrike, BleepingComputer). Compare Bash loader scripts, persistence mechanisms (e.g., `com.finder.helper.plist` in `/Library/LaunchDaemons/`), and C2 infrastructure. Identify analytic gaps such as missing malware samples or limited visibility into Russian targeting exclusions. Success metric: Document at least three unique overlaps or divergences and update attribution confidence accordingly. 3. On unmanaged or BYOD macOS endpoints, deploy and monitor: - EDR rules for unsanctioned Bash executions (`/bin/bash -c` \+ Base64) - DNS filtering for the three C2 domains - Browser-extension telemetry for sponsored search-result clicks Metrics: ≥90% reduction in unsanctioned Bash executions within 30 days; <2 false positives per 10,000 DNS queries after new RPZ rules; ≥80% user compliance with browser-extension deployment. Collect case studies or incident reports to validate control efficacy. --- # Forecast ## Short-Term Forecast (3–6 months) Shamos infostealer campaigns will almost certainly continue at moderate-to-high volume, primarily targeting macOS users in the U.S., U.K., and other Western nations—especially in the technology and education sectors. CrowdStrike blocked more than 300 infection attempts between June and August 2025, while ESET and Help Net Security recorded a sharp uptick in ClickFix malvertising during Q2–Q3 2025\. The lack of public breach notifications aligns with Shamos’s emphasis on credential theft and covert exfiltration rather than disruptive activity. Although EDR vendors report detections, true infection numbers are likely higher due to BYOD and unmanaged-device blind spots. We expect continued use of SEO poisoning, paid Google Ads, and brand impersonation, with minor code tweaks to bypass static defenses. **Quantitative Evidence** - CrowdStrike Falcon blocked 300+ Shamos attempts (Jun–Aug 2025). - ESET and Microsoft cited a “skyrocketing” use of ClickFix tactics in Q2 2025. - No breach notifications linked to Shamos as of 28 Aug 2025. **Examples** - CrowdStrike telemetry confirming sector and regional targeting. - 2024–2025 infostealer campaigns (AMOS, Stealerium) using malvertising and fake support sites. - Google Ads and SEO poisoning distributing malware (e.g., Homebrew malvertising, FrigidStealer). **What to Watch** - Rising Shamos IOCs in EDR/SIEM logs, especially on unmanaged macOS devices. - Newly registered fake support domains and malvertising tied to macOS troubleshooting. - User reports of suspicious Terminal commands or redirects to support-themed phishing sites. - Apple XProtect or Gatekeeper updates referencing Shamos/AMOS variants. --- ## Long-Term Forecast (12–24 months) We assess with moderate confidence that by late 2026–2027 Shamos and similar macOS infostealers will expand beyond technology and education into healthcare, legal, small business, financial services, and government. COE Security’s sectoral analysis and historical infostealer trends on Windows platforms support this outlook. The malware-as-a-service (MaaS) model will lower entry barriers, increasing campaign volume and geographic reach. Future variants will likely adopt notarized or signed payloads, exploit macOS 15+ features, and automate persistence through new Launch Daemon/Agent methods. As Apple strengthens Gatekeeper and XProtect and enterprises tighten MDM/EDR controls, actors may pivot to zero-day exploits and social-engineering lures on emerging platforms (e.g., TikTok, Discord). Attribution may blur as other eCrime groups adopt or purchase the TTPs. Regulatory and insurance pressures will spur stronger macOS baselines, yet BYOD-heavy and resource-constrained environments will remain vulnerable. **Quantitative Evidence** - COE Security notes rising macOS adoption and infostealer detections in financial, healthcare, retail, and government sectors. - No breach disclosures tied to Shamos as of Aug 2025, but cross-sector expansion mirrors Windows infostealer patterns. **Examples** - Evolution of Windows infostealer MaaS ecosystems (Raccoon, Vidar) enabling broad credential theft. - 2023–2025 malware authors using notarization and code signing to evade Gatekeeper/XProtect (AMOS, JockerSpy). - New threat actors adopting leaked or resold malware source code (e.g., Babuk). **What to Watch** - Shamos/AMOS variants employing notarized or signed payloads. - Lure themes and distribution vectors tailored to non-tech sectors. - Public breach disclosures or regulatory actions involving macOS infostealers. - New eCrime groups leveraging Shamos TTPs or cross-platform infostealer kits. - Apple advisories announcing detection logic for notarized or signed infostealer payloads. ## MITRE ATT&CK IDs T1059.004, T1566.002, T1204.001, T1027, T1555.003, T1119, T1071.001, T1547.001, T1036, T1082, T1005, T1562.001, T1218, T1189, T1596.003 --- # Appendix ## References 1. (2025-08-22) – [A new infostealer malware targeting Mac devices, called “Shamos,” has attempted infections against over three hundred environments worldwide.](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) 2. (2025-08-21) – [Shamos malware hits macOS via fake help sites, active IOCs](https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs?ref=blog.alphahunt.io) 3. (2025-08-25) – [Fake macOS support sites spread Shamos infostealer](https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/?ref=blog.alphahunt.io) ## AlphaHunt This **baseline** report was thoughtfully researched and took 30 minutes.. It's meant to be a rough draft for you to enhance with the unique insights that make you an invaluable analyst. We just did the initial grunt work.. Are you ready to level up your skillset? [Get Started Here!](http://alphahunt.io/?ref=blog.alphahunt.io) Did this help you? Forward it to a friend! (c) 2025 CSIRT Gadgets, LLC --- ## MITRE ATT&CK ### Techniques 1. \[T1059.004\] Command and Scripting Interpreter: Unix Shell – Shamos uses a one-line Bash command to download and execute its payload. - Fake support sites instruct users to run a Terminal command that decodes a Base64 string, retrieves a Bash script, and disables Gatekeeper. - BleepingComputer: [https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1059/004/](https://attack.mitre.org/techniques/T1059/004/?ref=blog.alphahunt.io) 2. \[T1204.001\] User Execution: Malicious Link – Victims are lured into executing a Terminal command from fake support sites. - Users searching for Mac troubleshooting help are tricked into running a Terminal command. - Rewterz: [https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs](https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1204/001/](https://attack.mitre.org/techniques/T1204/001/?ref=blog.alphahunt.io) 3. \[T1566.002\] Phishing: Link – Malvertising and paid search ads redirect users to attacker-controlled domains. - Paid ads promote fake support domains such as mac-safer\[.\]com and rescue-mac\[.\]com. - Infosecurity Magazine: [https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/](https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1566/002/](https://attack.mitre.org/techniques/T1566/002/?ref=blog.alphahunt.io) ### Procedures 1. \[T1547.001\] Boot or Logon Autostart Execution: Launch Daemon – Persistence is achieved by installing unauthorized plist files in `/Library/LaunchDaemons/`. - BleepingComputer: [https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1547/001/](https://attack.mitre.org/techniques/T1547/001/?ref=blog.alphahunt.io) 2. \[T1555.003\] Credentials from Password Stores: Credentials from macOS Keychain – Shamos attempts to extract credentials from the macOS Keychain. - Infosecurity Magazine: [https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/](https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1555/003/](https://attack.mitre.org/techniques/T1555/003/?ref=blog.alphahunt.io) 3. \[T1027\] Obfuscated Files or Information – The Bash loader and payloads are Base64-encoded to evade detection. - Rewterz: [https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs](https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/techniques/T1027/](https://attack.mitre.org/techniques/T1027/?ref=blog.alphahunt.io) ### Software 1. \[S1027\] Atomic macOS Stealer (AMOS) – Shamos is a variant of AMOS, sharing code and operational TTPs. - BleepingComputer: [https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/software/S1027/](https://attack.mitre.org/software/S1027/?ref=blog.alphahunt.io) 2. Bash (native utility; not catalogued as S1001 in ATT&CK v14) – Used for initial payload execution and script delivery. - Rewterz: [https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs](https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs?ref=blog.alphahunt.io) ### Mitigations 1. \[M1047\] Audit – Regularly audit `/Library/LaunchDaemons/` for unauthorized plist files to detect and remove persistence mechanisms. - BleepingComputer: [https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/mitigations/M1047/](https://attack.mitre.org/mitigations/M1047/?ref=blog.alphahunt.io) 2. \[M1042\] Disable or Remove Feature or Program – Enforce Gatekeeper and XProtect, and disable Safari’s “Open ‘safe’ files after downloading” to block automatic execution. - Apple Security Releases: [https://support.apple.com/en-us/HT201222](https://support.apple.com/en-us/HT201222?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/mitigations/M1042/](https://attack.mitre.org/mitigations/M1042/?ref=blog.alphahunt.io) 3. \[M1031\] Network Intrusion Prevention – Deploy ad blockers and DNS filtering to prevent access to malvertising and fake support domains. - Infosecurity Magazine: [https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/](https://www.infosecurity-magazine.com/news/fake-macos-spread-infostealer/?ref=blog.alphahunt.io) - MITRE: [https://attack.mitre.org/mitigations/M1031/](https://attack.mitre.org/mitigations/M1031/?ref=blog.alphahunt.io) ### Groups 1. COOKIE SPIDER (industry alias; not catalogued in ATT&CK v14) – Assessed with moderate confidence as the operator behind Shamos, based on shared infrastructure and scripting techniques. - CrowdStrike via BleepingComputer: [https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/](https://www.bleepingcomputer.com/news/security/fake-mac-fixes-trick-users-into-installing-new-shamos-infostealer/?ref=blog.alphahunt.io) 2. AMOS Operators (uncatalogued) – Associated with the development and distribution of AMOS, from which Shamos is derived. - Rewterz: [https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs](https://rewterz.com/threat-advisory/shamos-malware-hits-macos-via-fake-help-sites-active-iocs?ref=blog.alphahunt.io)