[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fIdS3x9E2Pptnr7qxiKF0X3ZH7fUWcWNhXvPHyxp4wpc":3},{"article":4,"iocs":45,"watch_terms":53,"solutions":54,"lesson":142},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"abe49990-e758-4ce6-a227-bd16f5819673","Amos Stealer Targets macOS Keychain Files and Browser Passwords","amos-stealer-targets-macos-keychain-files-and-browser-passwords-4383fa","Amos Stealer targets macOS users through fake downloads, stealing Keychain files, browser passwords, cookies, and developer configs for data theft.","Amos Stealer, an information-stealing malware, is actively targeting macOS users through deceptive downloads and social engineering. The malware silently collects browser passwords, Keychain files, developer configurations, and session cookies. It utilizes built-in macOS utilities like curl and AppleScript to exfiltrate data, compressing it into an archive before sending it to attacker-controlled servers.","Amos Stealer malware targets macOS users via fake downloads, stealing passwords and sensitive files.","https:\u002F\u002Fhackread.com\u002Famos-stealer-macos-keychain-files-browser-passwords\u002F","https:\u002F\u002Fhackread.com\u002Fwp-content\u002Fuploads\u002F2026\u002F06\u002Famos-stealer-macos-keychain-files-browser-passwords.png","2026-06-16T16:27:00+00:00","2026-06-16T18:00:06.372563+00:00",8,[17,20,22,24,27,29],{"name":18,"type":19},"macOS","product",{"name":21,"type":19},"Google Chrome",{"name":23,"type":19},"Microsoft Edge",{"name":25,"type":26},"curl","technology",{"name":28,"type":26},"AppleScript",{"name":30,"type":31},"CyberProof","vendor","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":32,"icon":34,"name":35,"slug":36},null,"Malware","malware",[38,40],{"category":39},{"id":32,"icon":34,"name":35,"slug":36},{"category":41},{"id":42,"icon":34,"name":43,"slug":44},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[46,50],{"type":47,"value":48,"context":49},"domain","bestbuydomain.com","Attacker-controlled server for data exfiltration.",{"type":36,"value":51,"context":52},"Amos Stealer","Information-stealing malware targeting macOS.",[30,18,21],{"controls":55,"vendors":135},[56,77,106],{"slug":57,"name":58,"problem":59,"products":60},"endpoint-management","Device management (MDM and UEM)","Every company laptop and phone is known, encrypted, locked down and up to date.",[61,69],{"vendor_slug":62,"vendor_name":63,"vendor_logo":64,"product_slug":65,"product_name":66,"url":67,"description":68},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":70,"vendor_name":71,"vendor_logo":72,"product_slug":73,"product_name":74,"url":75,"description":76},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"slug":78,"name":79,"problem":80,"products":81},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"bitdefender","Bitdefender","\u002Fvendor-logos\u002Fbitdefender.png","gravityzone","GravityZone","https:\u002F\u002Fwww.bitdefender.com\u002Fen-us\u002Fbusiness\u002Fgravityzone-platform\u002F","Endpoint protection, detection and response platform.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"withsecure","WithSecure","\u002Fvendor-logos\u002Fwithsecure.png","elements-xdr","WithSecure Elements XDR","https:\u002F\u002Fwww.withsecure.com\u002Fen\u002Ffor-business\u002Fplatform\u002Fxdr\u002F","Endpoint detection and response with extended detection, on the Elements cloud platform.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-edr","Huntress Managed EDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-edr","Endpoint detection and response monitored around the clock by Huntress analysts.",{"slug":107,"name":108,"problem":109,"products":110},"data-loss-prevention","Data loss prevention (DLP)","Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-dlp","Netskope DLP","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention for web, cloud apps, AI tools and endpoints.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"forcepoint","Forcepoint","\u002Fvendor-logos\u002Fforcepoint.png","forcepoint-dlp","Forcepoint DLP","https:\u002F\u002Fwww.forcepoint.com\u002Fproduct\u002Fdlp-data-loss-prevention","Data loss prevention for endpoints, network, email and cloud applications.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"proofpoint","Proofpoint","\u002Fvendor-logos\u002Fproofpoint.png","enterprise-dlp","Proofpoint Enterprise DLP","https:\u002F\u002Fwww.proofpoint.com\u002Fus\u002Fproducts\u002Fdata-loss-prevention","Data loss prevention across email, cloud and endpoints.",[136],{"slug":137,"name":138,"logo_path":139,"roles":140},"apple","Apple","\u002Fvendor-logos\u002Fapple.png",[141],"affected",{"slug":143,"title":144,"body":145,"framework_refs":146,"framework_notes":160},"amos-stealer-harvests-macos-credentials-via-social-engineering","Amos Stealer Harvests macOS Credentials via Social Engineering","Amos Stealer exploits user trust through deceptive downloads and social engineering to gain a foothold on macOS systems, highlighting the critical risk posed by malware that blends into legitimate user behavior. Once installed, it silently abuses native macOS utilities like curl and AppleScript — tools users and defenders may not flag as suspicious — to harvest and exfiltrate sensitive credentials, Keychain files, and session cookies. This matters because compromised session tokens and Keychain data can lead to full account takeovers across personal and enterprise services without requiring a password. The attack demonstrates that endpoint security cannot rely solely on patch management; user behavior and download hygiene are equally critical layers of defense.",[147,148,149,150,151,152,153,154,155,156,157,158,159],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 4: Secure Configuration of Enterprise Assets and Software","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","NIST SP 800-53 AC-3: Access Enforcement","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AU-12: Audit Record Generation","NIST SP 800-53 IA-5: Authenticator Management","NIST CSF DE.CM-1: Network Monitoring","GDPR Article 32: Security of Processing (for organizations handling EU personal data)","MITRE ATT&CK T1555.001: Keychain Access","MITRE ATT&CK T1041: Exfiltration Over C2 Channel","MITRE ATT&CK T1059.002: AppleScript Execution",{}]