We love the infostealer that turned your Mac into a gateway to the clandestine markets

Just a few years ago thinking of macOS as a relatively safe platform against malware was almost a certainty for many users. Today this perception is being challenged by families of malicious software known as infostealers, whose goal is not so much to destroy equipment as to squeeze them to extract valuable information and turn it into fast money into clandestine markets. A recent and especially illustrative example is the infostealer known as AMOS, which has evolved from a tool announced in dark web forums to a reusable component within a much wider criminal economy.

The infostealers do not function as a simple "virus": they act as automated credentials extractors, active sessions, cryptomoneda portfolios and sensitive documents. Once executed on a victim machine, go through browsers, system credentials storage, messaging applications, keyboards and local files to collect everything that has value for an attacker. This stolen database is not the end of the process, but the raw material: the resulting records - what industry calls "stealer logs" - are sold or exchanged in clandestine markets and closed channels, where different actors use them to take account control, empty portfolios or open initial access for subsequent operations.

The case of AMOS serves as an X-ray of how these threats operate today. Since its first appearance in Telegram forums, its kit was offered as a service with management panels, sending of logs by Telegram and payment options in cryptomonedas. Over time, developers and affiliates adjusted their offer and made it a service that other criminals can hire to spread malware, while specialized buyers buy records to run fraud or corporate network access. This fragmentation of work - some developing, some distributing and others monetizing - is one of the reasons why these campaigns have become so scalable.

What makes AMOS and similar campaigns particularly dangerous is not so much an extreme technical sophistication, but the ability to exploit human confidence and legitimate channels. In recent months we have seen a number of tactics that confirm it: from false repositories on development platforms that replicate legitimate installers and appear in search results, to the insertion of malicious "skills" into the extension markets for IA personal assistants. In one of the most ingenious designs, attackers publish alleged useful supplements - for example, tools for productivity, integration with services or benefits for cryptomoneda - that actually download and run the infostealer when the user accepts the installation. When markets and shops do not have rigorous review controls, these vectors become mass distribution channels.

Another method that has proven to be effective is the so-called "ClickFix" or execution by instructions: pages that appear legitimate guides induce the victim to paste a terminal line or drag a file to run an installer. In macOS, where many users assume that running commands is a developer thing, that trick is especially dangerous. The attackers also use SEO poisoning and maldumping to position malicious links in paid searches or organic results, so that someone looking for a popular application ends up in a site that offers a committed installer.

The media attention to the instrumentation of IA ecosystems is not free: in December 2025, a campaign was detected using the "shared chats" function of IA platforms to host misleading installation instructions in trusted domains, a vector that was publicly documented by researchers such as Huntress ( Huntress report). More recently, AMOS research has shown how personal assistant skills markets can be poisoned to engage users who install seemingly useful extensions - a modern form of software supply chain abuse.

Behind these campaigns is an organized economy. The Malware-as-a-Service model allows operators to offer subscription infostealers, and later buyers to acquire specific records according to their interest: access to corporate mail accounts, active browser sessions, SSH keys or portfolio information. These "stealer logs" become a commodity that runs forums and channels, and the value depends on the quality and utility of the data. Cybersecurity intelligence researchers and providers continue and categorize these exchanges precisely because anticipating the resale of credentials allows to mitigate accountability attacks before they materialize.

What can users and organizations do to reduce this risk? First, distrust shortcuts that promise speed: avoid hitting commands in Terminal without verifying the source and prefer installers distributed through official channels. Not every extension or skill is what it looks like., and the popularity of a tool does not guarantee that every complement in your markspot is safe. In corporate environments, implementing endpoints management and application control policies - block unauthorized facilities, limit administrative privileges and require software reviews - reduces the attack surface. Multifactor authentication is another critical barrier; whenever possible, prioritize phishing-resistant factors such as physical keys (FIDO2) or hardware-based solutions rather than SMS or mail codes.

For security equipment, monitoring signals outside the perimeter is becoming increasingly important. Tools and services that track the appearance of credentials or sessions in clandestine markets offer early warning to rotate committed passwords, force sessions to close or apply conditional access mitigation. It is also key to implement endpoints detection to identify typical infostealers behaviors - massive search for sensitive files, key-key removal or reading of browser profiles - and to combine it with network telemetry to block exfiltration. Organizations like Flare publish reports and monitoring services that exemplify this approach ( Identity Exposure Report 2026), and there are public resources to understand the economy behind malware ( analysis of the MaaS model).

There are no magic solutions: the threat evolves as fast as the techniques to distribute it. Therefore the defense is multifaceted and requires combining user education (not running unknown commands, verifying origins), technical controls (patch management, endpoints detection, robust MFA) and threat visibility outside the environment - monitoring of credentials and sessions on the dark web, and collaboration with intelligence providers. Reputational and control tools in marketplaces and repositories should be improved, but in the meantime the responsibility for prevention lies to a large extent in the technological prudence of organisations and users.

In addition to the studies of specialized intelligence firms, it is appropriate to review technical analysis and public recommendations on the disappearance of credentials and abuse of supply chains on platforms such as GitHub ( GitHub Security Blog), and use resources to check if your accounts have been filtered, such as Have I Been Pwned. Keeping informed and applying good basic practices reduces the likelihood of being the next victim to feed this lucrative underground market.