shamos

Shamos macOS Infostealer: Malvertising Lures, BYOD Gaps, and Sector Expansion

Shamos, a new Atomic macOS Stealer (AMOS) variant attributed to COOKIE SPIDER, is targeting U.S. tech and education sectors via malvertising and fake support sites.

Wes

02 Sep 2025 — 11 min read

College tip: if the ‘fix’ starts with ‘just paste this,’ your Keychain’s about to major in regret.

[FORECAST] Two New App-Layer Campaigns by Year-End? Watch the Attribution Line

Teams keep hardening the front door while the “trusted integration” gets waved through reception with a box truck. No core-platform exploit required. Just approval fatigue with API access.

[SIGNALS WEEKLY] Edge Devices, Identity Abuse, and KEV-Driven Exploitation Converge

The industry still talks like identity compromise begins at the login page. Meanwhile the path is edge box → DNS games → token theft → bad week for everyone pretending “strong auth” was the whole plan.

Anthropic’s Mythos Is Real. The Victory Lap Isn’t.

Everyone wants the AI bug hunter. Nobody wants the patch clock that comes with it. Mythos may be real. So is the part where leisurely patching starts looking like a career-limiting hobby.

[FORECAST] Beyond PLCs: Are Iran-Linked Operators More Likely to Chase New Targets, New Tooling, or New Impact? UPDATED 2026-04-08!

Everyone saw the PLC headline and immediately built their whole Iran take around exposed controllers. Cool. The nastier question is what happens when the next move comes through identity, admin planes, or some target class nobody staffed for.

Read more

[FORECAST] Two New App-Layer Campaigns by Year-End? Watch the Attribution Line

[SIGNALS WEEKLY] Edge Devices, Identity Abuse, and KEV-Driven Exploitation Converge

Anthropic’s Mythos Is Real. The Victory Lap Isn’t.

[FORECAST] Beyond PLCs: Are Iran-Linked Operators More Likely to Chase New Targets, New Tooling, or New Impact? UPDATED 2026-04-08!