shamos

Shamos macOS Infostealer: Malvertising Lures, BYOD Gaps, and Sector Expansion

Shamos, a new Atomic macOS Stealer (AMOS) variant attributed to COOKIE SPIDER, is targeting U.S. tech and education sectors via malvertising and fake support sites.

College tip: if the ‘fix’ starts with ‘just paste this,’ your Keychain’s about to major in regret.

[DEEP RESEARCH] The account stealing your data may not be human

The user may start the incident. OAuth apps, tokens, and integrations can turn it into quiet, scalable data theft.

[SIGNALS WEEKLY] Silent Surfaces: From Zero‑Click Mail to Exposed Controllers

Zero-click Zimbra access, exposed PLC tampering, and Teams-to-ransomware chains compress the defender’s window. Prioritize server logs, controller-change evidence, and external admin-surface discovery.

[FORECAST] The Patch Deadline Is Becoming an Attacker's Watchlist

We put a 30% chance on two public FCEB cases proving post-deadline edge exploitation by year-end.

[FORECAST] The breach may start after the patch

We put a 45% chance on a public case proving that stolen edge-appliance access survived remediation and enabled a later intrusion.

Read more

[DEEP RESEARCH] The account stealing your data may not be human

[SIGNALS WEEKLY] Silent Surfaces: From Zero‑Click Mail to Exposed Controllers

[FORECAST] The Patch Deadline Is Becoming an Attacker's Watchlist

[FORECAST] The breach may start after the patch