{ "intelligence": { "actors": [], "counts": { "actors": 0, "associated_entity_contexts": 1, "deduplicated_iocs": 17, "direct_entities": 36, "direct_relationships": 52, "invalid_iocs": 0, "iocs": 17, "mentioned": 2, "mitre_associated": 3, "mitre_direct": 1, "targets": 0, "techniques": 1, "unsupported_indicators": 0, "vulnerabilities": 0 }, "coverage": { "associated_repertoire_is_incident_evidence": false, "attribution_policy": "explicit-public-relationships-only", "descriptions_publicly_exported": false, "excluded_context_objects": 138, "excluded_graph_objects": 342, "graph_complete": true, "graph_objects": 36, "graph_relationships": 52, "mitre_context_complete": true, "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "status_as_of": "2026-10-10T08:24:42+00:00", "table_preview_limit": 20 }, "direct_entities": [ { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.629Z", "created_at": "2026-09-26T12:07:40.714Z", "modified": "2026-09-26T12:08:00.333Z", "updated_at": "2026-09-26T12:08:00.333Z" }, "description_available": false, "entity_type": "Indicator", "id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--bfc9b9ef-710c-5fdc-8c1c-517af3bd7876", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.593Z", "created_at": "2026-09-26T12:07:32.033Z", "modified": "2026-09-26T12:07:34.686Z", "updated_at": "2026-09-26T12:07:34.686Z" }, "description_available": false, "entity_type": "Indicator", "id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--a983fced-2a6e-5d21-b9c3-8c859d01f789", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.623Z", "created_at": "2026-09-26T12:07:39.797Z", "modified": "2026-09-26T12:08:02.769Z", "updated_at": "2026-09-26T12:08:02.769Z" }, "description_available": false, "entity_type": "Indicator", "id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--d81174d0-f2ac-5195-94be-6195ca81579f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.615Z", "created_at": "2026-09-26T12:07:37.793Z", "modified": "2026-09-26T12:07:56.508Z", "updated_at": "2026-09-26T12:07:56.508Z" }, "description_available": false, "entity_type": "Indicator", "id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--53c635ae-2980-5e96-9395-4769f60b4819", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha256" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.607Z", "created_at": "2026-09-26T12:07:35.120Z", "modified": "2026-10-03T02:38:13.012Z", "updated_at": "2026-10-03T02:38:13.012Z" }, "description_available": false, "entity_type": "Indicator", "id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "c50b9391-afd1-4953-bfa0-14d0ecd8feb1", "source_name": "ThreatFox source reference", "url": "https://www.virustotal.com/gui/file/6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--9c523a56-a15b-57aa-b6e3-a5ad7abb5890", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:27.330Z", "updated_at": "2026-09-26T12:07:27.837Z" }, "description_available": false, "entity_type": "StixFile", "id": "25740b2e-dc9a-48cd-99c2-f3eec7e6fe9c", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--34e9d6bb-b0b0-5309-8600-1b6e11edde6a", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.610Z", "created_at": "2026-09-26T12:07:36.333Z", "modified": "2026-09-26T12:07:50.083Z", "updated_at": "2026-09-26T12:07:50.083Z" }, "description_available": false, "entity_type": "Indicator", "id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--5ca57a4b-8816-50ff-b32c-d8f5ef7cfabf", "type": "Indicator" }, { "__typename": "Malware", "aliases": [ "Atomic macOS Stealer", "osx.amos" ], "attributes": { "is_family": true, "malware_types": [ "bot" ] }, "authorized_members": [], "confidence": 50, "created_by": { "authorized_members": [], "id": "1b7caa41-88e1-4a38-8cfc-62b85639333a", "is_inferred": false, "name": "Malpedia", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "restrict_access": false, "type": "Organization" }, "dates": { "created": "2026-01-18T17:56:41.819Z", "created_at": "2026-01-18T21:06:25.601Z", "first_seen": "1970-01-01T00:00:00.000Z", "last_seen": "5138-11-16T09:46:40.000Z", "modified": "2026-10-07T03:13:43.761Z", "updated_at": "2026-10-07T03:13:43.761Z" }, "description_available": true, "entity_type": "Malware", "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "is_inferred": false, "labels": [ "as208137", "botnet_cc", "c2", "fps12", "odyssey", "stealer" ], "lang": "en", "name": "AMOS", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "e89c2187-260b-4f54-9229-4a95be43b81e", "source_name": "malpedia", "url": "https://blog.cyble.com/2023/04/26/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/" }, { "external_id": null, "id": "9eaa3160-38f3-4862-8a51-eb3285d6fe66", "source_name": "malpedia", "url": "https://cyble.com/blog/cyble-chronicles-february-1-latest-findings-recommendations-for-the-cybersecurity-community/" }, { "external_id": null, "id": "823101fb-403b-4c45-91f5-43960507ab81", "source_name": "malpedia", "url": "https://denshiyurei.medium.com/silent-echoes-the-hidden-dialogue-among-malware-entities-spotlight-on-amos-infostealer-6d7cd70e3219" }, { "external_id": null, "id": "7f378525-c3dd-4a2e-935c-132fa227c8b2", "source_name": "malpedia", "url": "https://denwp.com/amos-stealer-fud/" }, { "external_id": null, "id": "4196e239-8ea7-4b25-9e07-97c62a968365", "source_name": "malpedia", "url": "https://hunt.io/blog/macos-odyssey-amos-malware-campaign" }, { "external_id": null, "id": "443ba04c-18fc-461b-a2d6-e91066e05735", "source_name": "malpedia", "url": "https://labs.k7computing.com/index.php/mentalpositives-new-macos-stealer-amos-repackaged-or-a-new-cyber-threat/" }, { "external_id": null, "id": "57fa8e7f-ab5e-4565-8da9-dea5b1d0ee2e", "source_name": "malpedia", "url": "https://malpedia.caad.fkie.fraunhofer.de/details/osx.amos" }, { "external_id": null, "id": "d2b25bc0-7142-4b4d-b6fe-6482f62085be", "source_name": "malpedia", "url": "https://medium.com/@ireneusz.tarnowski/multi-stage-malware-delivery-campaign-using-seo-poisoning-and-serverless-infrastructure-34e05e551fa3" }, { "external_id": null, "id": "ff7dbb00-4fd9-4bf4-ad53-1d7b6bcec23c", "source_name": "malpedia", "url": "https://redcanary.com/blog/threat-detection/atomic-stealer/" }, { "external_id": null, "id": "7427d1b9-3605-4d35-8591-715c1f33cd84", "source_name": "malpedia", "url": "https://redcanary.com/blog/threat-intelligence/atomic-odyssey-poseidon-stealers/" }, { "external_id": null, "id": "e023298b-34f2-41da-93cf-4f390ca67042", "source_name": "malpedia", "url": "https://russianpanda.com/2024/01/15/Atomic-Stealer-AMOS/" }, { "external_id": null, "id": "98e4e3a6-7fd8-4616-b283-18c885847899", "source_name": "malpedia", "url": "https://securelist.com/crimeware-report-fakesg-akira-amos/111483/" }, { "external_id": null, "id": "f347be62-4dfc-4147-bb88-f8fc79b92e99", "source_name": "malpedia", "url": "https://spycloud.com/blog/reverse-engineering-atomic-macos-stealer/" }, { "external_id": null, "id": "c1032365-e9e0-44ab-b0ee-9d37c31b65ad", "source_name": "malpedia", "url": "https://www.bitdefender.com/blog/labs/when-stealers-converge-new-variant-of-atomic-stealer-in-the-wild/" }, { "external_id": null, "id": "04b1e107-fe39-4950-929e-38db20b48eb6", "source_name": "malpedia", "url": "https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust" }, { "external_id": null, "id": "65d9a25d-363d-4690-ba24-2b2a15674ee2", "source_name": "malpedia", "url": "https://www.intrinsec.com/wp-content/uploads/2025/10/TLP-CLEAR-31072025-ShadowSyndicate-infrastructure-illumination-EN.pdf" }, { "external_id": null, "id": "fa71b90c-f903-48c5-9c54-0013d112f94c", "source_name": "malpedia", "url": "https://www.kroll.com/en/publications/cyber/new-amos-infection-vector-highlights-risks-around-ai-adoption" }, { "external_id": null, "id": "abdb48d8-618e-4268-a52c-dd57482312b9", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware" }, { "external_id": null, "id": "d6b0e584-2fb4-4e3c-8d8d-7713404f726c", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/threat-intelligence/2023/09/atomic-macos-stealer-delivered-via-malvertising" }, { "external_id": null, "id": "9feea419-ff63-4bc3-a7ba-8352a59db067", "source_name": "malpedia", "url": "https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version" }, { "external_id": null, "id": "ec042f45-fcfd-4852-8a9f-d43af6a782e9", "source_name": "malpedia", "url": "https://www.recordedfuture.com/the-travels-of-markopolo-self-proclaimed-meeting-software-vortax-spreads-infostealers" }, { "external_id": null, "id": "b5ab2ff7-cd7b-40d6-b81e-9ece230f389b", "source_name": "malpedia", "url": "https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "malware--31137ce9-53cc-51b1-b312-fece28375ce3", "type": "Malware" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:20.126Z", "updated_at": "2026-09-26T12:07:21.186Z" }, "description_available": false, "entity_type": "StixFile", "id": "3be7c17b-67d0-4dad-b705-c890af7e705a", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--d2ff38e3-a68d-5dcb-8333-2740b539a022", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:26.059Z", "updated_at": "2026-09-26T12:07:27.167Z" }, "description_available": false, "entity_type": "StixFile", "id": "4131102d-3aff-478a-ac9d-7cd66dcee025", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--67c6dec2-2724-55d9-a0d2-d007bb89cdaa", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.599Z", "created_at": "2026-09-26T12:07:33.817Z", "modified": "2026-09-26T12:07:43.828Z", "updated_at": "2026-09-26T12:07:43.828Z" }, "description_available": false, "entity_type": "Indicator", "id": "4237937a-37af-4087-abcc-7245b305fc31", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--c1ff9fb1-2a43-5ac1-9aa4-4c1a2532fb92", "type": "Indicator" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:17.601Z", "updated_at": "2026-09-26T12:07:18.688Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "46550bfc-e9fb-46f4-a246-ec9a3b5ffc2e", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "domain-name--4a125187-6ba9-5a00-99ba-cb28973cb95d", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "sha256" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.604Z", "created_at": "2026-09-26T12:07:34.758Z", "modified": "2026-10-03T02:37:58.239Z", "updated_at": "2026-10-03T02:37:58.239Z" }, "description_available": false, "entity_type": "Indicator", "id": "491d0efd-3858-414e-a594-8b254ce2f255", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "c50b9391-afd1-4953-bfa0-14d0ecd8feb1", "source_name": "ThreatFox source reference", "url": "https://www.virustotal.com/gui/file/6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--924a9b85-4a84-5c39-a4cd-f95efb5ba0a0", "type": "Indicator" }, { "__typename": "AttackPattern", "aliases": [], "attributes": { "x_mitre_id": "T1547.011" }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-24T07:08:28.227Z", "created_at": "2026-04-23T03:32:45.532Z", "modified": "2026-04-23T03:32:46.001Z", "updated_at": "2026-04-23T03:32:46.001Z" }, "description_available": false, "entity_type": "Attack-Pattern", "id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "is_inferred": false, "labels": [], "lang": "en", "name": "T1547.011", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1547.011", "id": "62847de4-ffae-4ca9-9509-aaed8ebdfb97", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/011" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "attack-pattern--17095ab6-35d3-54d9-afc0-d30878614b27", "type": "AttackPattern" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-08-08T16:19:48.058Z", "updated_at": "2026-09-26T12:07:19.546Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "5c94846c-78a9-4d25-a230-2096dbd4606d", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "beacon", "clickfix", "dante", "macos", "payload_delivery" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "domain-name--7330dbac-9808-5d55-9090-163efe940c6d", "type": "DomainName" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.602Z", "created_at": "2026-09-26T12:07:33.813Z", "modified": "2026-09-26T12:07:41.888Z", "updated_at": "2026-09-26T12:07:41.888Z" }, "description_available": false, "entity_type": "Indicator", "id": "5fed47e2-df29-46a5-a560-f9e777fde130", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--d086fad5-c56b-5c2f-bb58-5111648f8a21", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:19.464Z", "updated_at": "2026-09-26T12:07:19.735Z" }, "description_available": false, "entity_type": "StixFile", "id": "61aad316-18cf-42ed-843c-fcd1deb21b1b", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--a8d40412-648c-55c0-81a5-d9ea9264b834", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.596Z", "created_at": "2026-09-26T12:07:33.417Z", "modified": "2026-09-26T12:07:39.046Z", "updated_at": "2026-09-26T12:07:39.046Z" }, "description_available": false, "entity_type": "Indicator", "id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--123aaec6-8291-5e32-bdcb-28b4aefe02a4", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:20.278Z", "updated_at": "2026-09-26T12:07:21.240Z" }, "description_available": false, "entity_type": "StixFile", "id": "740a8fd6-72f0-4493-b643-2259d6d673a7", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--8afb8fee-51a6-5663-857c-401182cf6cf0", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.591Z", "created_at": "2026-09-26T12:07:32.036Z", "modified": "2026-09-26T12:07:36.906Z", "updated_at": "2026-09-26T12:07:36.906Z" }, "description_available": false, "entity_type": "Indicator", "id": "762942a3-8b97-46be-a3fd-c17493a9c036", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--4c2aee41-943f-5c77-8458-3922d609a611", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.632Z", "created_at": "2026-09-26T12:07:42.597Z", "modified": "2026-09-26T12:08:06.935Z", "updated_at": "2026-09-26T12:08:06.935Z" }, "description_available": false, "entity_type": "Indicator", "id": "7b4dda49-2009-441c-bf39-e73c29856faa", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--3f5acdb1-0c4b-5671-bfc8-1190d49f2b4f", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.612Z", "created_at": "2026-09-26T12:07:37.217Z", "modified": "2026-09-26T12:07:52.957Z", "updated_at": "2026-09-26T12:07:52.957Z" }, "description_available": false, "entity_type": "Indicator", "id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--893296d3-be2f-51d1-947e-9a8d8415f5e7", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.620Z", "created_at": "2026-09-26T12:07:38.742Z", "modified": "2026-09-26T12:07:58.377Z", "updated_at": "2026-09-26T12:07:58.377Z" }, "description_available": false, "entity_type": "Indicator", "id": "86a58328-c48c-419c-bfd0-23724212a798", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--91f4c7ef-5f81-5253-b097-42e601f862cc", "type": "Indicator" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.618Z", "created_at": "2026-09-26T12:07:38.086Z", "modified": "2026-09-26T12:07:54.650Z", "updated_at": "2026-09-26T12:07:54.650Z" }, "description_available": false, "entity_type": "Indicator", "id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--0b607a73-4760-53ba-a16d-6be631846f9e", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:22.233Z", "updated_at": "2026-09-26T12:07:23.739Z" }, "description_available": false, "entity_type": "StixFile", "id": "98491fa1-622f-43d9-a058-1d642195a9da", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--413fa6ae-bc12-59d1-b908-8975c6bbb4a2", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "indicator_types": [ "domain" ], "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "Domain-Name", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:17:34.556Z", "created_at": "2026-08-08T16:19:51.110Z", "modified": "2026-09-26T12:07:33.035Z", "updated_at": "2026-09-26T12:07:33.035Z" }, "description_available": false, "entity_type": "Indicator", "id": "adb0e366-146e-45eb-a096-6203391193c5", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "beacon", "clickfix", "dante", "macos", "payload_delivery" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": null, "id": "64fa1038-93e5-4847-ac4d-759a5ea6f9ab", "source_name": "ThreatFox source reference", "url": "https://github.com/raimurokko/macos-threat-tracking/blob/main/campaigns/2026-08-04-cloudflare-clickfix/payload_analysis.md" } ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--6dc76ffe-736e-56a2-b485-e90cde5f1204", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:30.664Z", "updated_at": "2026-09-26T12:07:31.166Z" }, "description_available": false, "entity_type": "StixFile", "id": "bbbaa7d7-2212-47e6-94cd-7676ceb89591", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--068463ab-36f6-595c-aca7-7e9f9fc05152", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:22.230Z", "updated_at": "2026-10-03T02:38:05.335Z" }, "description_available": false, "entity_type": "StixFile", "id": "c0b3d2e4-6820-4582-b29b-76dcff766bf1", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--71a7dd0f-f55d-5a36-9091-d414c6003dfc", "type": "StixFile" }, { "__typename": "Indicator", "aliases": [], "attributes": { "pattern_type": "stix", "pattern_version": "2.1", "x_opencti_detection": false, "x_opencti_main_observable_type": "StixFile", "x_opencti_score": 50 }, "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.627Z", "created_at": "2026-09-26T12:07:39.797Z", "modified": "2026-09-26T12:08:05.453Z", "updated_at": "2026-09-26T12:08:05.453Z" }, "description_available": false, "entity_type": "Indicator", "id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "indicator--eca4de87-a21b-5f49-a089-a318066d96b3", "type": "Indicator" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:26.062Z", "updated_at": "2026-09-26T12:07:27.168Z" }, "description_available": false, "entity_type": "StixFile", "id": "d0ffed58-0309-41b6-a210-8ab5dd54356a", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--25030e80-8c17-5396-a48e-13dad0a8217f", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:29.190Z", "updated_at": "2026-09-26T12:07:31.109Z" }, "description_available": false, "entity_type": "StixFile", "id": "d1fcf249-e210-4a65-bbfb-89c4dadbdde1", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--db7acb0b-18a4-5706-a0de-a1d04403f5a6", "type": "StixFile" }, { "__typename": "DomainName", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:14.051Z", "updated_at": "2026-09-26T12:07:17.242Z" }, "description_available": false, "entity_type": "Domain-Name", "id": "d8999d06-7634-4251-ace4-e22852b4bf5e", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "domain-name--8c33fdba-593f-5c55-bfc5-a383c403e1be", "type": "DomainName" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:30.223Z", "updated_at": "2026-09-26T12:07:31.164Z" }, "description_available": false, "entity_type": "StixFile", "id": "dae5843b-7a65-4b6e-8e88-40b01e463108", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--7323be3e-909c-5d1a-9e9a-b141688043db", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:24.448Z", "updated_at": "2026-09-26T12:07:25.723Z" }, "description_available": false, "entity_type": "StixFile", "id": "dfabd495-61d6-4aea-91fb-01316f2704c0", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--184e4f78-0e47-55ed-afaa-7f8c7d720a35", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:28.005Z", "updated_at": "2026-09-26T12:07:28.991Z" }, "description_available": false, "entity_type": "StixFile", "id": "edf17329-1b43-453a-96c7-d31c9f074c57", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--03389da3-0ce3-5c34-8f75-a191ff6f26df", "type": "StixFile" }, { "__typename": "StixFile", "aliases": [], "attributes": {}, "authorized_members": [], "confidence": null, "created_by": null, "dates": { "created_at": "2026-09-26T12:07:21.714Z", "updated_at": "2026-10-03T02:37:49.378Z" }, "description_available": false, "entity_type": "StixFile", "id": "f3507b3d-b9e7-47bd-b19d-1245478804ae", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": null, "name": null, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "file--033d248b-7422-5714-88eb-301a9084c43f", "type": "StixFile" } ], "direct_relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.802Z", "created_at": "2026-09-26T12:12:20.288Z", "modified": "2026-09-26T12:12:20.493Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:20.493Z" }, "description_available": false, "entity_type": "indicates", "fromId": "86a58328-c48c-419c-bfd0-23724212a798", "from_id": "86a58328-c48c-419c-bfd0-23724212a798", "from_name": null, "from_type": "Indicator", "id": "0173aa03-c920-4414-b568-100cf725a19d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--55964cee-c064-521a-b86b-c789dcc448c1", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.772Z", "created_at": "2026-09-26T12:11:44.290Z", "modified": "2026-09-26T12:11:44.461Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:44.461Z" }, "description_available": false, "entity_type": "indicates", "fromId": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_name": null, "from_type": "Indicator", "id": "109809c8-d6e1-4452-b069-de8810013e93", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--332f7900-6670-5c0c-9221-98c51f47a777", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.777Z", "created_at": "2026-09-26T12:11:53.724Z", "modified": "2026-09-26T12:11:54.177Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:54.177Z" }, "description_available": false, "entity_type": "indicates", "fromId": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_name": null, "from_type": "Indicator", "id": "10a5641f-3a61-45e2-98e3-aea57a31f4b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--086c9722-f13f-5203-956d-bfbf42a37f28", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.837Z", "created_at": "2026-09-26T12:12:43.231Z", "modified": "2026-09-26T12:12:43.434Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:43.434Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_name": null, "from_type": "Indicator", "id": "13a4255c-b654-4001-a9f9-dd5f7766ce47", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--f1f12179-db15-5196-b9cb-bab1d3dd3e4b", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.628Z", "created_at": "2026-09-26T12:07:57.038Z", "modified": "2026-09-26T12:07:58.351Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:58.351Z" }, "description_available": false, "entity_type": "based-on", "fromId": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_name": null, "from_type": "Indicator", "id": "29625b72-3c64-48a6-a0df-ab15f0b17629", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--f2a767e9-88f0-5041-b0b1-2b60729ae06f", "toId": "d1fcf249-e210-4a65-bbfb-89c4dadbdde1", "to_id": "d1fcf249-e210-4a65-bbfb-89c4dadbdde1", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.617Z", "created_at": "2026-09-26T12:07:55.222Z", "modified": "2026-09-26T12:07:55.723Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:55.723Z" }, "description_available": false, "entity_type": "based-on", "fromId": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "from_name": null, "from_type": "Indicator", "id": "3f6ba980-a589-4079-a522-73455a821e3f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--a8ecb588-c302-5597-879a-a816d90fdc0a", "toId": "d0ffed58-0309-41b6-a210-8ab5dd54356a", "to_id": "d0ffed58-0309-41b6-a210-8ab5dd54356a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.592Z", "created_at": "2026-09-26T12:07:49.701Z", "modified": "2026-09-26T12:07:50.446Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:50.446Z" }, "description_available": false, "entity_type": "based-on", "fromId": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_id": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_name": null, "from_type": "Indicator", "id": "4b61f04c-8604-4ffb-a361-4c3b373f6aed", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--902dd40b-0a58-595f-a80a-84337df9427b", "toId": "d8999d06-7634-4251-ace4-e22852b4bf5e", "to_id": "d8999d06-7634-4251-ace4-e22852b4bf5e", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.849Z", "created_at": "2026-09-26T12:12:59.230Z", "modified": "2026-09-26T12:12:59.471Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:59.471Z" }, "description_available": false, "entity_type": "indicates", "fromId": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_name": null, "from_type": "Indicator", "id": "4b93f56c-9a2b-438c-bba5-2eb687e53d5c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--36d5d620-c311-51c0-ba71-61ef2d81bd34", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.646Z", "created_at": "2026-09-26T12:08:43.816Z", "modified": "2026-09-26T12:08:46.265Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:08:46.265Z" }, "description_available": false, "entity_type": "indicates", "fromId": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_id": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_name": null, "from_type": "Indicator", "id": "4e73fa75-8184-49b2-8ee9-d421588c0d22", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--48464285-91df-5d1f-a79a-c9c6eb100edd", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.694Z", "created_at": "2026-09-26T12:10:22.839Z", "modified": "2026-09-26T12:10:24.267Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:10:24.267Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_id": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_name": null, "from_type": "Indicator", "id": "4fc558cc-c304-4e29-a339-22db727a611d", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--8df2cb4d-07a2-5915-bcba-fc4910cbf974", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.598Z", "created_at": "2026-09-26T12:07:51.360Z", "modified": "2026-09-26T12:07:52.333Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:52.333Z" }, "description_available": false, "entity_type": "based-on", "fromId": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_name": null, "from_type": "Indicator", "id": "5570ac3e-c126-4213-9448-e4154386e877", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--63c2e5f2-bb81-5788-8ba8-16efc663bcab", "toId": "61aad316-18cf-42ed-843c-fcd1deb21b1b", "to_id": "61aad316-18cf-42ed-843c-fcd1deb21b1b", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.570Z", "created_at": "2026-09-26T12:07:44.431Z", "modified": "2026-09-26T12:07:45.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:45.134Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--beaed072-c988-5837-b512-383f4ecfa981", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.622Z", "created_at": "2026-09-26T12:07:56.367Z", "modified": "2026-09-26T12:07:56.967Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:56.967Z" }, "description_available": false, "entity_type": "based-on", "fromId": "86a58328-c48c-419c-bfd0-23724212a798", "from_id": "86a58328-c48c-419c-bfd0-23724212a798", "from_name": null, "from_type": "Indicator", "id": "6077e74e-d629-4cf5-bd2e-58f8596c5516", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--134d4166-ee27-5532-ab13-2f22055e4e0d", "toId": "25740b2e-dc9a-48cd-99c2-f3eec7e6fe9c", "to_id": "25740b2e-dc9a-48cd-99c2-f3eec7e6fe9c", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.662Z", "created_at": "2026-09-26T12:09:37.881Z", "modified": "2026-09-26T12:09:38.142Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:09:38.142Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_name": null, "from_type": "Indicator", "id": "616da9c2-fd3e-47ac-9584-273b3b412eb5", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--865638d8-1605-5ca5-8a4f-520692b757e3", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.786Z", "created_at": "2026-09-26T12:12:06.348Z", "modified": "2026-09-26T12:12:06.944Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:06.944Z" }, "description_available": false, "entity_type": "indicates", "fromId": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_name": null, "from_type": "Indicator", "id": "6335ea9f-5c6d-4771-9dbf-ccd12d9c8654", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--642b272b-4f11-55d9-8028-05f9a1b724bf", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.669Z", "created_at": "2026-09-26T12:09:45.621Z", "modified": "2026-09-26T12:09:45.895Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:09:45.895Z" }, "description_available": false, "entity_type": "indicates", "fromId": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_name": null, "from_type": "Indicator", "id": "66c4dd3c-40b4-4af5-b3e1-10c915926fe8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--2a1d158c-9dbe-537e-bb9b-ae9943e0d436", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.765Z", "created_at": "2026-09-26T12:11:35.432Z", "modified": "2026-09-26T12:11:35.709Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:35.709Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_name": null, "from_type": "Indicator", "id": "689bdedf-74af-42b5-82a2-1b32932804fe", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--85b2d3de-4ebf-5977-a9cc-4ab1e191e5da", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.634Z", "created_at": "2026-09-26T12:07:58.963Z", "modified": "2026-09-26T12:07:59.540Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:59.540Z" }, "description_available": false, "entity_type": "indicates", "fromId": "adb0e366-146e-45eb-a096-6203391193c5", "from_id": "adb0e366-146e-45eb-a096-6203391193c5", "from_name": null, "from_type": "Indicator", "id": "768a06b1-b270-41f5-82d5-1db35d95c709", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--fb9aeadf-66d7-56d1-975f-e80201ba1b70", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.821Z", "created_at": "2026-09-26T12:12:31.816Z", "modified": "2026-09-26T12:12:32.087Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:32.087Z" }, "description_available": false, "entity_type": "indicates", "fromId": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_name": null, "from_type": "Indicator", "id": "7ae1a44d-7e75-472b-a13a-8e0656c1052a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--aa02b827-7874-5f93-a152-f89bb53334a9", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.687Z", "created_at": "2026-09-26T12:10:14.009Z", "modified": "2026-09-26T12:10:14.383Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:10:14.383Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4237937a-37af-4087-abcc-7245b305fc31", "from_id": "4237937a-37af-4087-abcc-7245b305fc31", "from_name": null, "from_type": "Indicator", "id": "7b4d400f-0db9-4b91-bdff-337315005a6b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--ed09c401-8a4c-5f6c-9092-a3180428ab12", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.830Z", "created_at": "2026-09-26T12:12:36.580Z", "modified": "2026-09-26T12:12:37.005Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:37.005Z" }, "description_available": false, "entity_type": "indicates", "fromId": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_name": null, "from_type": "Indicator", "id": "82e3ff70-598e-4d13-9b85-efff4a793814", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--fb13ee49-29e6-5311-8999-4522fb35ef50", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.600Z", "created_at": "2026-09-26T12:07:51.356Z", "modified": "2026-09-26T12:07:52.334Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:52.334Z" }, "description_available": false, "entity_type": "based-on", "fromId": "4237937a-37af-4087-abcc-7245b305fc31", "from_id": "4237937a-37af-4087-abcc-7245b305fc31", "from_name": null, "from_type": "Indicator", "id": "8becb7da-8bfe-4bf4-b020-dce60fdb4e6e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--62478724-462f-5dc3-b2f5-7e5d96620a29", "toId": "3be7c17b-67d0-4dad-b705-c890af7e705a", "to_id": "3be7c17b-67d0-4dad-b705-c890af7e705a", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.639Z", "created_at": "2026-09-26T12:08:06.374Z", "modified": "2026-09-26T12:08:06.569Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:08:06.569Z" }, "description_available": false, "entity_type": "indicates", "fromId": "adb0e366-146e-45eb-a096-6203391193c5", "from_id": "adb0e366-146e-45eb-a096-6203391193c5", "from_name": null, "from_type": "Indicator", "id": "90ebebeb-c376-4377-88d8-c65434602d97", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--1dc5bdd5-4143-59ef-acd1-3720d29bc541", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.700Z", "created_at": "2026-09-26T12:10:41.693Z", "modified": "2026-09-26T12:10:42.004Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:10:42.004Z" }, "description_available": false, "entity_type": "indicates", "fromId": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_id": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_name": null, "from_type": "Indicator", "id": "92545b47-0fa8-4766-b8d7-0a6cac9ad063", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--2d319c9d-a04e-56aa-a025-9b0ab3a2f486", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.721Z", "created_at": "2026-09-26T12:10:57.941Z", "modified": "2026-10-03T07:13:29.902Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T07:13:29.902Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_name": null, "from_type": "Indicator", "id": "9d04b2f2-e075-467c-8e3c-e017945302e0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--97bbf7cf-24ea-57b2-9041-0efcdc7044ab", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-08-08T12:17:34.560Z", "created_at": "2026-08-08T23:03:55.897Z", "modified": "2026-09-26T12:07:52.681Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:52.681Z" }, "description_available": false, "entity_type": "based-on", "fromId": "adb0e366-146e-45eb-a096-6203391193c5", "from_id": "adb0e366-146e-45eb-a096-6203391193c5", "from_name": null, "from_type": "Indicator", "id": "9e6f21bd-fda2-4cff-bea4-94f0816e283e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--1bf3b12b-2431-58fb-b320-a6d7df70ce7b", "toId": "5c94846c-78a9-4d25-a230-2096dbd4606d", "to_id": "5c94846c-78a9-4d25-a230-2096dbd4606d", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.625Z", "created_at": "2026-09-26T12:07:56.363Z", "modified": "2026-09-26T12:07:56.704Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:56.704Z" }, "description_available": false, "entity_type": "based-on", "fromId": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "from_name": null, "from_type": "Indicator", "id": "9f583c68-8299-4c13-b4e2-58de1015a932", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--584acbaf-94e5-5cc1-93ae-5064933960e5", "toId": "edf17329-1b43-453a-96c7-d31c9f074c57", "to_id": "edf17329-1b43-453a-96c7-d31c9f074c57", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.682Z", "created_at": "2026-09-26T12:10:00.780Z", "modified": "2026-09-26T12:10:01.157Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:10:01.157Z" }, "description_available": false, "entity_type": "indicates", "fromId": "4237937a-37af-4087-abcc-7245b305fc31", "from_id": "4237937a-37af-4087-abcc-7245b305fc31", "from_name": null, "from_type": "Indicator", "id": "a0f5014d-0977-4eb1-a2f8-7bdb324d91dc", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--afbae829-ce20-5353-8ff2-c65920fc457c", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.603Z", "created_at": "2026-09-26T12:07:52.786Z", "modified": "2026-09-26T12:07:53.523Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:53.523Z" }, "description_available": false, "entity_type": "based-on", "fromId": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_id": "5fed47e2-df29-46a5-a560-f9e777fde130", "from_name": null, "from_type": "Indicator", "id": "a31ba27b-dbd6-4f59-baad-ae707d92cef8", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--bbd17222-6ed7-5a6d-a5ba-7e1f418e418e", "toId": "740a8fd6-72f0-4493-b643-2259d6d673a7", "to_id": "740a8fd6-72f0-4493-b643-2259d6d673a7", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.866Z", "created_at": "2026-09-26T12:13:17.269Z", "modified": "2026-09-26T12:13:17.483Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:13:17.483Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_id": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_name": null, "from_type": "Indicator", "id": "ad0660a6-a667-43d3-81c2-f8ae09e48509", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--a9765630-1ac3-5cdb-b2b5-1a96d4bd7322", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.714Z", "created_at": "2026-09-26T12:10:48.722Z", "modified": "2026-09-26T12:10:49.353Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:10:49.353Z" }, "description_available": false, "entity_type": "indicates", "fromId": "491d0efd-3858-414e-a594-8b254ce2f255", "from_id": "491d0efd-3858-414e-a594-8b254ce2f255", "from_name": null, "from_type": "Indicator", "id": "b037b51d-c1f5-449f-b94b-0884466a4d24", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--edf22343-6478-50dd-829b-7898e2d85fcb", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.745Z", "created_at": "2026-09-26T12:11:22.795Z", "modified": "2026-09-26T12:11:23.199Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:23.199Z" }, "description_available": false, "entity_type": "indicates", "fromId": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_name": null, "from_type": "Indicator", "id": "b81997fe-d562-46ba-b758-8e1d2dcde28a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--d27cffcb-e7d4-57cf-ab9f-fdb78bc0d591", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.854Z", "created_at": "2026-09-26T12:13:03.630Z", "modified": "2026-09-26T12:13:03.834Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:13:03.834Z" }, "description_available": false, "entity_type": "indicates", "fromId": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_name": null, "from_type": "Indicator", "id": "b884633a-a317-4424-90ed-2646a0451af2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--8bc31726-7ba8-5d33-be64-f6e77209b933", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.737Z", "created_at": "2026-09-26T12:11:12.724Z", "modified": "2026-09-26T12:11:13.147Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:13.147Z" }, "description_available": false, "entity_type": "indicates", "fromId": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_name": null, "from_type": "Indicator", "id": "bbf05555-ea3d-4730-9cc3-8b1450a50475", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--3997860d-a292-50f5-a76b-61e1e78e3543", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.810Z", "created_at": "2026-09-26T12:12:24.885Z", "modified": "2026-09-26T12:12:25.151Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:25.151Z" }, "description_available": false, "entity_type": "indicates", "fromId": "86a58328-c48c-419c-bfd0-23724212a798", "from_id": "86a58328-c48c-419c-bfd0-23724212a798", "from_name": null, "from_type": "Indicator", "id": "bdf9d7f1-5808-4b78-8f89-15e66662842e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--37ee0bbb-e0ed-5a7c-9a86-e94cd6f45e8d", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.619Z", "created_at": "2026-09-26T12:07:56.016Z", "modified": "2026-09-26T12:07:56.409Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:56.409Z" }, "description_available": false, "entity_type": "based-on", "fromId": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_name": null, "from_type": "Indicator", "id": "c2c8e953-d5a4-45bf-85c8-894b8631f5b9", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--4ba76a52-48b6-5962-aa60-d26bd353a6b6", "toId": "4131102d-3aff-478a-ac9d-7cd66dcee025", "to_id": "4131102d-3aff-478a-ac9d-7cd66dcee025", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.675Z", "created_at": "2026-09-26T12:09:51.190Z", "modified": "2026-09-26T12:09:51.426Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:09:51.426Z" }, "description_available": false, "entity_type": "indicates", "fromId": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "from_name": null, "from_type": "Indicator", "id": "c3e96f75-9c30-4dba-afdd-4f56b6ae8074", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--ac07c4c0-f21c-550a-800c-66674ddeea7f", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.757Z", "created_at": "2026-09-26T12:11:30.515Z", "modified": "2026-09-26T12:11:30.728Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:30.728Z" }, "description_available": false, "entity_type": "indicates", "fromId": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_name": null, "from_type": "Indicator", "id": "c87237f5-5751-4534-a6c9-d2149da1fbd7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--938226f5-7bec-5986-afcf-ab228c3811d0", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.861Z", "created_at": "2026-09-26T12:13:11.215Z", "modified": "2026-09-26T12:13:11.695Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:13:11.695Z" }, "description_available": false, "entity_type": "indicates", "fromId": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_id": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_name": null, "from_type": "Indicator", "id": "cb334d69-f445-4bcb-87db-99046b86894e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--a27cfc16-ed21-512f-b80a-70bfb0cca2da", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.634Z", "created_at": "2026-09-26T12:07:58.442Z", "modified": "2026-09-26T12:07:58.894Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:58.894Z" }, "description_available": false, "entity_type": "based-on", "fromId": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_id": "7b4dda49-2009-441c-bf39-e73c29856faa", "from_name": null, "from_type": "Indicator", "id": "d1cfb2de-bf88-4456-88dc-d88d622ab812", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--718255ab-d03e-5d53-930e-c7f3832b991c", "toId": "bbbaa7d7-2212-47e6-94cd-7676ceb89591", "to_id": "bbbaa7d7-2212-47e6-94cd-7676ceb89591", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.842Z", "created_at": "2026-09-26T12:12:49.534Z", "modified": "2026-09-26T12:12:49.822Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:49.822Z" }, "description_available": false, "entity_type": "indicates", "fromId": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "from_name": null, "from_type": "Indicator", "id": "d2146537-1b97-4a71-afc0-2900321e8374", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--d3d46922-939c-5445-9be8-30b971577f5a", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.793Z", "created_at": "2026-09-26T12:12:12.123Z", "modified": "2026-09-26T12:12:12.381Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:12:12.381Z" }, "description_available": false, "entity_type": "indicates", "fromId": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "from_name": null, "from_type": "Indicator", "id": "d9eb7894-b780-4298-a739-f6ef737f6028", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--5195ac47-cdad-5c53-92bb-8df78a7fc2a2", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.611Z", "created_at": "2026-09-26T12:07:55.152Z", "modified": "2026-09-26T12:07:55.433Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:55.433Z" }, "description_available": false, "entity_type": "based-on", "fromId": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "from_name": null, "from_type": "Indicator", "id": "dc2cdd7b-f649-46c6-89a8-ce34495d79e7", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--f742a768-528b-5b2f-935e-b743d08eab15", "toId": "98491fa1-622f-43d9-a058-1d642195a9da", "to_id": "98491fa1-622f-43d9-a058-1d642195a9da", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.708Z", "created_at": "2026-09-26T12:10:42.410Z", "modified": "2026-10-03T07:13:10.159Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T07:13:10.159Z" }, "description_available": false, "entity_type": "indicates", "fromId": "491d0efd-3858-414e-a594-8b254ce2f255", "from_id": "491d0efd-3858-414e-a594-8b254ce2f255", "from_name": null, "from_type": "Indicator", "id": "e70bbaff-6ea8-4279-b8d4-21dbe5f848b4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--14430281-fa48-57fa-a405-01677a730d99", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.651Z", "created_at": "2026-09-26T12:09:21.531Z", "modified": "2026-09-26T12:09:21.978Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:09:21.978Z" }, "description_available": false, "entity_type": "indicates", "fromId": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_id": "762942a3-8b97-46be-a3fd-c17493a9c036", "from_name": null, "from_type": "Indicator", "id": "e8908df5-8b66-4953-9f6e-4a71f7f10d2e", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--9ea4c896-2536-55b0-a569-062c50b91bb2", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.657Z", "created_at": "2026-09-26T12:09:31.316Z", "modified": "2026-09-26T12:09:31.678Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:09:31.678Z" }, "description_available": false, "entity_type": "indicates", "fromId": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_name": null, "from_type": "Indicator", "id": "ecc9510d-daf8-4b9c-a5f1-833ca9a41d86", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--5d4585d4-71f7-5284-83c3-640db6e8b52d", "toId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "to_name": "AMOS", "to_type": "Malware" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.726Z", "created_at": "2026-09-26T12:11:11.382Z", "modified": "2026-09-26T12:11:11.572Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:11:11.572Z" }, "description_available": false, "entity_type": "indicates", "fromId": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_name": null, "from_type": "Indicator", "id": "f677a190-fdf4-4e36-8670-8560547508cb", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "indicates", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--f4ebaec2-f129-5ba2-8489-ac92977d72cd", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.606Z", "created_at": "2026-09-26T12:07:52.790Z", "modified": "2026-10-03T07:13:07.221Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T07:13:07.221Z" }, "description_available": false, "entity_type": "based-on", "fromId": "491d0efd-3858-414e-a594-8b254ce2f255", "from_id": "491d0efd-3858-414e-a594-8b254ce2f255", "from_name": null, "from_type": "Indicator", "id": "f8e2a039-96a2-43d6-ad59-f5c1712ebc1f", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--7a3b3270-5179-58f0-a1ae-392aaae10b46", "toId": "f3507b3d-b9e7-47bd-b19d-1245478804ae", "to_id": "f3507b3d-b9e7-47bd-b19d-1245478804ae", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.631Z", "created_at": "2026-09-26T12:07:58.085Z", "modified": "2026-09-26T12:07:58.672Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:58.672Z" }, "description_available": false, "entity_type": "based-on", "fromId": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "from_name": null, "from_type": "Indicator", "id": "fb977e84-2f5b-44cc-85db-897d17afe205", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--a8fcea27-de7a-57f7-adaa-8a277c2a995b", "toId": "dae5843b-7a65-4b6e-8e88-40b01e463108", "to_id": "dae5843b-7a65-4b6e-8e88-40b01e463108", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.614Z", "created_at": "2026-09-26T12:07:55.225Z", "modified": "2026-09-26T12:07:55.724Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:55.724Z" }, "description_available": false, "entity_type": "based-on", "fromId": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "from_name": null, "from_type": "Indicator", "id": "fbf24b4b-e3d2-4d6b-baac-553bd9df875a", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--e89f6977-6ec9-5d3c-9618-bcf7c2cbb7f8", "toId": "dfabd495-61d6-4aea-91fb-01316f2704c0", "to_id": "dfabd495-61d6-4aea-91fb-01316f2704c0", "to_name": null, "to_type": "StixFile" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.595Z", "created_at": "2026-09-26T12:07:49.789Z", "modified": "2026-09-26T12:07:50.447Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:50.447Z" }, "description_available": false, "entity_type": "based-on", "fromId": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "from_name": null, "from_type": "Indicator", "id": "fde60c1e-4b0f-49a5-9a34-f7ef308d05d4", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--35e612ee-0fe9-59d1-b290-009c1d9ec5ad", "toId": "46550bfc-e9fb-46f4-a246-ec9a3b5ffc2e", "to_id": "46550bfc-e9fb-46f4-a246-ec9a3b5ffc2e", "to_name": null, "to_type": "DomainName" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.608Z", "created_at": "2026-09-26T12:07:53.056Z", "modified": "2026-10-03T07:13:23.616Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-10-03T07:13:23.616Z" }, "description_available": false, "entity_type": "based-on", "fromId": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "from_name": null, "from_type": "Indicator", "id": "fe52d2c6-b60d-48be-94bb-c9457bead7b2", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "based-on", "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--9fe50a50-141b-5444-b4e4-6c1abcea2262", "toId": "c0b3d2e4-6820-4582-b29b-76dcff766bf1", "to_id": "c0b3d2e4-6820-4582-b29b-76dcff766bf1", "to_name": null, "to_type": "StixFile" } ], "iocs": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "ferncore13[.]com", "description_available": false, "object_id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "object_ids": [ "0da000a8-1d5f-4838-ae19-6c931668b4e1", "46550bfc-e9fb-46f4-a246-ec9a3b5ffc2e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "0da000a8-1d5f-4838-ae19-6c931668b4e1", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2026-12-28T03:31:29.260Z", "validity_status": "active", "value": "ferncore13.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "46550bfc-e9fb-46f4-a246-ec9a3b5ffc2e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "ferncore13.com" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "domain", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2026-12-28T03:31:29.260Z", "validity_status": "active", "value": "ferncore13.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "getmacouscloud[.]com", "description_available": false, "object_id": "762942a3-8b97-46be-a3fd-c17493a9c036", "object_ids": [ "762942a3-8b97-46be-a3fd-c17493a9c036", "d8999d06-7634-4251-ace4-e22852b4bf5e" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "762942a3-8b97-46be-a3fd-c17493a9c036", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2026-12-28T03:31:29.260Z", "validity_status": "active", "value": "getmacouscloud.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "d8999d06-7634-4251-ace4-e22852b4bf5e", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "getmacouscloud.com" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "domain", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2026-12-28T03:31:29.260Z", "validity_status": "active", "value": "getmacouscloud.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "grove-89[.]com", "description_available": false, "object_id": "adb0e366-146e-45eb-a096-6203391193c5", "object_ids": [ "5c94846c-78a9-4d25-a230-2096dbd4606d", "adb0e366-146e-45eb-a096-6203391193c5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "adb0e366-146e-45eb-a096-6203391193c5", "valid_from": "2026-08-08T12:17:34.556Z", "valid_until": "2026-11-19T03:12:42.816Z", "validity_status": "active", "value": "grove-89.com" }, { "classification": "observable", "confidence": null, "context": "Objet DomainName explicitement associé au rapport source.", "object_id": "5c94846c-78a9-4d25-a230-2096dbd4606d", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "grove-89.com" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "domain", "valid_from": "2026-08-08T12:17:34.556Z", "valid_until": "2026-11-19T03:12:42.816Z", "validity_status": "active", "value": "grove-89.com" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "121cc0f6c933f928273a8d259262e3bd", "description_available": false, "object_id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "object_ids": [ "25b8d94b-b241-4219-85d4-a6cf019db4ad", "98491fa1-622f-43d9-a058-1d642195a9da" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "25b8d94b-b241-4219-85d4-a6cf019db4ad", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "121cc0f6c933f928273a8d259262e3bd" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "98491fa1-622f-43d9-a058-1d642195a9da", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "121cc0f6c933f928273a8d259262e3bd" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "md5", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "121cc0f6c933f928273a8d259262e3bd" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "3106cffb9da7380fcc0237e8fde0efa0", "description_available": false, "object_id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "object_ids": [ "83242a18-4e3c-44c5-b82d-73a9fe595680", "dfabd495-61d6-4aea-91fb-01316f2704c0" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "83242a18-4e3c-44c5-b82d-73a9fe595680", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "3106cffb9da7380fcc0237e8fde0efa0" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "dfabd495-61d6-4aea-91fb-01316f2704c0", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "3106cffb9da7380fcc0237e8fde0efa0" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "md5", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "3106cffb9da7380fcc0237e8fde0efa0" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "65334575232f8d94fde18e89af393212", "description_available": false, "object_id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "object_ids": [ "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "d0ffed58-0309-41b6-a210-8ab5dd54356a" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "19bb8f88-16c9-4c17-ad66-5ef1f44a69f0", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "65334575232f8d94fde18e89af393212" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d0ffed58-0309-41b6-a210-8ab5dd54356a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "65334575232f8d94fde18e89af393212" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "md5", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "65334575232f8d94fde18e89af393212" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "e634d35d6ae98935c51de5a23a92e965", "description_available": false, "object_id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "object_ids": [ "4131102d-3aff-478a-ac9d-7cd66dcee025", "874f630c-3da1-40a7-91a3-329ff55f33b5" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "874f630c-3da1-40a7-91a3-329ff55f33b5", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "e634d35d6ae98935c51de5a23a92e965" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "4131102d-3aff-478a-ac9d-7cd66dcee025", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "e634d35d6ae98935c51de5a23a92e965" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "md5", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "e634d35d6ae98935c51de5a23a92e965" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2849fe272d6edfdf75c1169102ea7a33d224eb7b", "description_available": false, "object_id": "86a58328-c48c-419c-bfd0-23724212a798", "object_ids": [ "25740b2e-dc9a-48cd-99c2-f3eec7e6fe9c", "86a58328-c48c-419c-bfd0-23724212a798" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "86a58328-c48c-419c-bfd0-23724212a798", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "2849fe272d6edfdf75c1169102ea7a33d224eb7b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "25740b2e-dc9a-48cd-99c2-f3eec7e6fe9c", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2849fe272d6edfdf75c1169102ea7a33d224eb7b" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha1", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "2849fe272d6edfdf75c1169102ea7a33d224eb7b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "2c78ad15bec38dd235f1a0f91a8ec71ecdf2701b", "description_available": false, "object_id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "object_ids": [ "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "edf17329-1b43-453a-96c7-d31c9f074c57" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "14f7919d-d0c5-40e3-8dcc-74b03d335af2", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "2c78ad15bec38dd235f1a0f91a8ec71ecdf2701b" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "edf17329-1b43-453a-96c7-d31c9f074c57", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "2c78ad15bec38dd235f1a0f91a8ec71ecdf2701b" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha1", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "2c78ad15bec38dd235f1a0f91a8ec71ecdf2701b" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "65b02a832483a5fa367d96c36c56372722e752cc", "description_available": false, "object_id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "object_ids": [ "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "d1fcf249-e210-4a65-bbfb-89c4dadbdde1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "cf480ea0-8697-40b4-87cf-6edc95b04cfe", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "65b02a832483a5fa367d96c36c56372722e752cc" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "d1fcf249-e210-4a65-bbfb-89c4dadbdde1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "65b02a832483a5fa367d96c36c56372722e752cc" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha1", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "65b02a832483a5fa367d96c36c56372722e752cc" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "739afb0e43501a8aa6e4322fafb6841a880f0271", "description_available": false, "object_id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "object_ids": [ "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "dae5843b-7a65-4b6e-8e88-40b01e463108" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "077ed8e7-49e1-45bc-8b3e-5bcc4bd9ae49", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "739afb0e43501a8aa6e4322fafb6841a880f0271" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "dae5843b-7a65-4b6e-8e88-40b01e463108", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "739afb0e43501a8aa6e4322fafb6841a880f0271" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha1", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "739afb0e43501a8aa6e4322fafb6841a880f0271" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9", "description_available": false, "object_id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "object_ids": [ "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "c0b3d2e4-6820-4582-b29b-76dcff766bf1" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "1cdf0aee-f49d-4b2c-886c-2e7892affa6f", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "c0b3d2e4-6820-4582-b29b-76dcff766bf1", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688", "description_available": false, "object_id": "7b4dda49-2009-441c-bf39-e73c29856faa", "object_ids": [ "7b4dda49-2009-441c-bf39-e73c29856faa", "bbbaa7d7-2212-47e6-94cd-7676ceb89591" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "7b4dda49-2009-441c-bf39-e73c29856faa", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "bbbaa7d7-2212-47e6-94cd-7676ceb89591", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620", "description_available": false, "object_id": "491d0efd-3858-414e-a594-8b254ce2f255", "object_ids": [ "491d0efd-3858-414e-a594-8b254ce2f255", "f3507b3d-b9e7-47bd-b19d-1245478804ae" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "491d0efd-3858-414e-a594-8b254ce2f255", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "f3507b3d-b9e7-47bd-b19d-1245478804ae", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c", "description_available": false, "object_id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "object_ids": [ "61aad316-18cf-42ed-843c-fcd1deb21b1b", "71f207ff-954b-4137-bd8e-3b75cf1a731f" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "71f207ff-954b-4137-bd8e-3b75cf1a731f", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "61aad316-18cf-42ed-843c-fcd1deb21b1b", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a", "description_available": false, "object_id": "4237937a-37af-4087-abcc-7245b305fc31", "object_ids": [ "3be7c17b-67d0-4dad-b705-c890af7e705a", "4237937a-37af-4087-abcc-7245b305fc31" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "4237937a-37af-4087-abcc-7245b305fc31", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "3be7c17b-67d0-4dad-b705-c890af7e705a", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a" }, { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "defanged": "a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9", "description_available": false, "object_id": "5fed47e2-df29-46a5-a560-f9e777fde130", "object_ids": [ "5fed47e2-df29-46a5-a560-f9e777fde130", "740a8fd6-72f0-4493-b643-2259d6d673a7" ], "source_objects": [ { "classification": "indicator", "confidence": 50, "context": "Objet Indicator explicitement associé au rapport source.", "object_id": "5fed47e2-df29-46a5-a560-f9e777fde130", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9" }, { "classification": "observable", "confidence": null, "context": "Objet StixFile explicitement associé au rapport source.", "object_id": "740a8fd6-72f0-4493-b643-2259d6d673a7", "valid_from": null, "valid_until": null, "validity_status": "undated", "value": "a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9" } ], "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "type": "sha256", "valid_from": "2026-09-16T12:36:21.000Z", "valid_until": "2027-07-03T23:46:05.557Z", "validity_status": "active", "value": "a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9" } ], "mentioned": [ { "confidence": 50, "evidence_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "name": "T1547.011", "role": "mentionné", "type": "Attack-Pattern" }, { "confidence": 50, "evidence_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "role": "mentionné", "type": "Malware" } ], "mitre": { "associated_repertoire": [ { "complete": true, "relationships": [ { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-24T16:56:55.570Z", "created_at": "2026-09-26T12:07:44.431Z", "modified": "2026-09-26T12:07:45.134Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-09-26T12:07:45.134Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--beaed072-c988-5837-b512-383f4ecfa981", "toId": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "to_name": "T1547.011", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-02-17T08:30:15.781Z", "created_at": "2026-04-21T13:42:31.696Z", "modified": "2026-04-21T13:42:32.538Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-04-21T13:42:32.538Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "b3ef85a7-87b7-4982-8d5b-7358f6e2296b", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--60a5ab56-308d-557a-888a-182d713fc081", "toId": "ea4de683-0cad-4497-a044-65b61045d534", "to_id": "ea4de683-0cad-4497-a044-65b61045d534", "to_name": "T1574.002", "to_type": "AttackPattern" }, { "__typename": "StixCoreRelationship", "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-01-19T19:03:20.926Z", "created_at": "2026-03-05T15:27:09.826Z", "modified": "2026-03-05T15:27:10.237Z", "start_time": "1970-01-01T00:00:00.000Z", "stop_time": "5138-11-16T09:46:40.000Z", "updated_at": "2026-03-05T15:27:10.237Z" }, "description_available": false, "entity_type": "uses", "fromId": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "from_name": "AMOS", "from_type": "Malware", "id": "d376288d-a101-4cc9-9473-6bbc0d40c47c", "is_inferred": false, "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [], "relationship_type": "uses", "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "standard_id": "relationship--4a2cb37a-102a-597b-ba51-a5892068d4dc", "toId": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_id": "0c43fa3c-1023-4011-bc40-c398438711c9", "to_name": "T1094", "to_type": "AttackPattern" } ], "scope": "entity-context", "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1094" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:04:28.695Z", "created_by": null, "dates": { "created": "2026-01-18T18:04:28.695Z", "created_at": "2026-01-18T22:32:58.220Z", "modified": "2026-01-18T22:33:01.087Z", "updated_at": "2026-01-18T22:33:01.087Z" }, "description_available": false, "evidence_ids": [ "0c43fa3c-1023-4011-bc40-c398438711c9", "d376288d-a101-4cc9-9473-6bbc0d40c47c" ], "external_id": "T1094", "id": "0c43fa3c-1023-4011-bc40-c398438711c9", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1094", "modified": "2026-01-18T22:33:01.087Z", "name": "T1094", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1094", "id": "fb43a6ff-5bf1-40b3-8e1c-ce8220f7163b", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1094" } ], "relationship_ids": [ "d376288d-a101-4cc9-9473-6bbc0d40c47c" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1094/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1547.011" }, "authorized_members": [], "confidence": 50, "created": "2026-02-24T07:08:28.227Z", "created_by": null, "dates": { "created": "2026-02-24T07:08:28.227Z", "created_at": "2026-04-23T03:32:45.532Z", "modified": "2026-04-23T03:32:46.001Z", "updated_at": "2026-04-23T03:32:46.001Z" }, "description_available": false, "evidence_ids": [ "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0" ], "external_id": "T1547.011", "id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1547.011", "modified": "2026-04-23T03:32:46.001Z", "name": "T1547.011", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1547.011", "id": "62847de4-ffae-4ca9-9509-aaed8ebdfb97", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/011" } ], "relationship_ids": [ "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1547/011/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] }, { "aliases": [], "attributes": { "x_mitre_id": "T1574.002" }, "authorized_members": [], "confidence": 50, "created": "2026-01-18T18:28:11.149Z", "created_by": null, "dates": { "created": "2026-01-18T18:28:11.149Z", "created_at": "2026-01-21T11:31:18.951Z", "modified": "2026-01-21T11:31:19.843Z", "updated_at": "2026-01-21T11:31:19.843Z" }, "description_available": false, "evidence_ids": [ "b3ef85a7-87b7-4982-8d5b-7358f6e2296b", "ea4de683-0cad-4497-a044-65b61045d534" ], "external_id": "T1574.002", "id": "ea4de683-0cad-4497-a044-65b61045d534", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1574.002", "modified": "2026-01-21T11:31:19.843Z", "name": "T1574.002", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1574.002", "id": "7a1e1096-14a3-4673-8aa4-da93b15cb955", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1574/002" } ], "relationship_ids": [ "b3ef85a7-87b7-4982-8d5b-7358f6e2296b" ], "restrict_access": false, "revoked": false, "scope": "entity-context", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1574/002/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] } ], "via_entity": { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } } ], "direct_techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1547.011" }, "authorized_members": [], "confidence": 50, "created": "2026-02-24T07:08:28.227Z", "created_by": null, "dates": { "created": "2026-02-24T07:08:28.227Z", "created_at": "2026-04-23T03:32:45.532Z", "modified": "2026-04-23T03:32:46.001Z", "updated_at": "2026-04-23T03:32:46.001Z" }, "description_available": false, "evidence_ids": [ "10a5641f-3a61-45e2-98e3-aea57a31f4b2", "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "616da9c2-fd3e-47ac-9584-273b3b412eb5", "689bdedf-74af-42b5-82a2-1b32932804fe", "7b4d400f-0db9-4b91-bdff-337315005a6b", "82e3ff70-598e-4d13-9b85-efff4a793814", "90ebebeb-c376-4377-88d8-c65434602d97", "92545b47-0fa8-4766-b8d7-0a6cac9ad063", "ad0660a6-a667-43d3-81c2-f8ae09e48509", "b037b51d-c1f5-449f-b94b-0884466a4d24", "b81997fe-d562-46ba-b758-8e1d2dcde28a", "b884633a-a317-4424-90ed-2646a0451af2", "bdf9d7f1-5808-4b78-8f89-15e66662842e", "c3e96f75-9c30-4dba-afdd-4f56b6ae8074", "d2146537-1b97-4a71-afc0-2900321e8374", "d9eb7894-b780-4298-a739-f6ef737f6028", "e8908df5-8b66-4953-9f6e-4a71f7f10d2e", "f677a190-fdf4-4e36-8670-8560547508cb" ], "external_id": "T1547.011", "id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1547.011", "modified": "2026-04-23T03:32:46.001Z", "name": "T1547.011", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1547.011", "id": "62847de4-ffae-4ca9-9509-aaed8ebdfb97", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/011" } ], "relationship_ids": [ "10a5641f-3a61-45e2-98e3-aea57a31f4b2", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "616da9c2-fd3e-47ac-9584-273b3b412eb5", "689bdedf-74af-42b5-82a2-1b32932804fe", "7b4d400f-0db9-4b91-bdff-337315005a6b", "82e3ff70-598e-4d13-9b85-efff4a793814", "90ebebeb-c376-4377-88d8-c65434602d97", "92545b47-0fa8-4766-b8d7-0a6cac9ad063", "ad0660a6-a667-43d3-81c2-f8ae09e48509", "b037b51d-c1f5-449f-b94b-0884466a4d24", "b81997fe-d562-46ba-b758-8e1d2dcde28a", "b884633a-a317-4424-90ed-2646a0451af2", "bdf9d7f1-5808-4b78-8f89-15e66662842e", "c3e96f75-9c30-4dba-afdd-4f56b6ae8074", "d2146537-1b97-4a71-afc0-2900321e8374", "d9eb7894-b780-4298-a739-f6ef737f6028", "e8908df5-8b66-4953-9f6e-4a71f7f10d2e", "f677a190-fdf4-4e36-8670-8560547508cb" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1547/011/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] } ], "official_catalog": { "complete": true, "fetched_at": "2026-10-10T08:24:44Z", "schema_version": 1, "source_sha256": "6227cd8ff0e21fc6355dc871dcad6a354b0d36570d2c3b783667577320378730", "source_url": "https://raw.githubusercontent.com/mitre-attack/attack-stix-data/master/enterprise-attack/enterprise-attack.json", "techniques": [ { "attack_version": "1.1", "canonical_url": "https://attack.mitre.org/techniques/T1094/", "created": "2017-05-31T21:31:10.314Z", "deprecated": false, "matched": true, "mitre_id": "T1094", "modified": "2025-10-24T17:49:37.745Z", "official_name": "Custom Command and Control Protocol", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0011", "name": "Command and Control", "shortname": "command-and-control" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1095/", "mitre_id": "T1095", "official_name": "Non-Application Layer Protocol", "official_status": "active", "relationship_id": "relationship--e4a43af9-e8f0-42cf-a707-b2393efb44f5", "stix_id": "attack-pattern--c21d5a77-d422-4a69-acd7-2c53c1faa34b" } ], "revoked": true, "stix_id": "attack-pattern--f72eb8a8-cd4c-461d-a814-3f862befbf00" }, { "attack_version": "1.2", "canonical_url": "https://attack.mitre.org/techniques/T1547/011/", "created": "2020-01-24T20:02:59.149Z", "deprecated": false, "matched": true, "mitre_id": "T1547.011", "modified": "2025-10-24T17:48:53.190Z", "official_name": "Plist Modification", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0003", "name": "Persistence", "shortname": "persistence" }, { "mitre_id": "TA0004", "name": "Privilege Escalation", "shortname": "privilege-escalation" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1647/", "mitre_id": "T1647", "official_name": "Plist File Modification", "official_status": "active", "relationship_id": "relationship--6f75a833-d53e-41bb-942b-cef4f3f076c3", "stix_id": "attack-pattern--7d20fff9-8751-404e-badd-ccd71bda0236" } ], "revoked": true, "stix_id": "attack-pattern--6747daa2-3533-4e78-8fb8-446ebb86448a" }, { "attack_version": "2.1", "canonical_url": "https://attack.mitre.org/techniques/T1574/002/", "created": "2020-03-13T19:41:37.908Z", "deprecated": false, "matched": true, "mitre_id": "T1574.002", "modified": "2026-04-15T22:56:43.434Z", "official_name": "DLL Side-Loading", "official_status": "revoked", "official_tactics": [ { "mitre_id": "TA0002", "name": "Execution", "shortname": "execution" }, { "mitre_id": "TA0005", "name": "Stealth", "shortname": "stealth" } ], "replacements": [ { "canonical_url": "https://attack.mitre.org/techniques/T1574/001/", "mitre_id": "T1574.001", "official_name": "DLL", "official_status": "active", "relationship_id": "relationship--7bb3a367-c3fd-4981-8d95-8ba142f92cf2", "stix_id": "attack-pattern--2fee9321-3e71-4cf4-af24-d4d40d355b34" } ], "revoked": true, "stix_id": "attack-pattern--e64c62cf-9cd7-4a14-94ec-cdaac43ab44b" } ] } }, "report_metadata": { "authorized_members": [], "confidence": 50, "created_by": null, "dates": { "created": "2026-09-16T12:36:20.282Z", "created_at": "2026-09-26T12:13:36.311Z", "modified": "2026-09-26T12:13:38.740Z", "published": "2026-09-16T12:36:20.282Z", "updated_at": "2026-09-26T12:13:38.740Z" }, "description_available": true, "id": "81884f53-7173-490b-8df7-1eb35c31231d", "is_inferred": false, "labels": [ "amos", "atomic macos stealer", "clickfix", "macos" ], "lang": "en", "name": "Atomic macOS (AMOS) Stealer Activity", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "published": "2026-09-16T12:36:20.282Z", "references": [ { "external_id": null, "id": "3d244993-c2db-406f-b0de-38ff68207a67", "source_name": "alien-vault", "url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/" }, { "external_id": "6aaa8d441e620055d07313f1", "id": "5509bba2-bc6d-4f72-b260-a7d306d61797", "source_name": "alien-vault", "url": "https://otx.alienvault.com/pulse/6aaa8d441e620055d07313f1" } ], "report_types": [ "threat-report" ], "restrict_access": false, "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/" }, "targets": [], "techniques": [ { "aliases": [], "attributes": { "x_mitre_id": "T1547.011" }, "authorized_members": [], "confidence": 50, "created": "2026-02-24T07:08:28.227Z", "created_by": null, "dates": { "created": "2026-02-24T07:08:28.227Z", "created_at": "2026-04-23T03:32:45.532Z", "modified": "2026-04-23T03:32:46.001Z", "updated_at": "2026-04-23T03:32:46.001Z" }, "description_available": false, "evidence_ids": [ "10a5641f-3a61-45e2-98e3-aea57a31f4b2", "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "616da9c2-fd3e-47ac-9584-273b3b412eb5", "689bdedf-74af-42b5-82a2-1b32932804fe", "7b4d400f-0db9-4b91-bdff-337315005a6b", "82e3ff70-598e-4d13-9b85-efff4a793814", "90ebebeb-c376-4377-88d8-c65434602d97", "92545b47-0fa8-4766-b8d7-0a6cac9ad063", "ad0660a6-a667-43d3-81c2-f8ae09e48509", "b037b51d-c1f5-449f-b94b-0884466a4d24", "b81997fe-d562-46ba-b758-8e1d2dcde28a", "b884633a-a317-4424-90ed-2646a0451af2", "bdf9d7f1-5808-4b78-8f89-15e66662842e", "c3e96f75-9c30-4dba-afdd-4f56b6ae8074", "d2146537-1b97-4a71-afc0-2900321e8374", "d9eb7894-b780-4298-a739-f6ef737f6028", "e8908df5-8b66-4953-9f6e-4a71f7f10d2e", "f677a190-fdf4-4e36-8670-8560547508cb" ], "external_id": "T1547.011", "id": "4bebc1d2-d1bb-4605-8d20-987325da5ff8", "is_inferred": false, "kill_chain_phases": [], "labels": [], "lang": "en", "mitre_id": "T1547.011", "modified": "2026-04-23T03:32:46.001Z", "name": "T1547.011", "objectMarking": [ { "definition": "TLP:CLEAR", "definition_type": "TLP" } ], "objectOrganization": [], "references": [ { "external_id": "T1547.011", "id": "62847de4-ffae-4ca9-9509-aaed8ebdfb97", "source_name": "mitre-attack", "url": "https://attack.mitre.org/techniques/T1547/011" } ], "relationship_ids": [ "10a5641f-3a61-45e2-98e3-aea57a31f4b2", "5c1debad-6a68-4c34-91b8-f99c0bc3c7c0", "616da9c2-fd3e-47ac-9584-273b3b412eb5", "689bdedf-74af-42b5-82a2-1b32932804fe", "7b4d400f-0db9-4b91-bdff-337315005a6b", "82e3ff70-598e-4d13-9b85-efff4a793814", "90ebebeb-c376-4377-88d8-c65434602d97", "92545b47-0fa8-4766-b8d7-0a6cac9ad063", "ad0660a6-a667-43d3-81c2-f8ae09e48509", "b037b51d-c1f5-449f-b94b-0884466a4d24", "b81997fe-d562-46ba-b758-8e1d2dcde28a", "b884633a-a317-4424-90ed-2646a0451af2", "bdf9d7f1-5808-4b78-8f89-15e66662842e", "c3e96f75-9c30-4dba-afdd-4f56b6ae8074", "d2146537-1b97-4a71-afc0-2900321e8374", "d9eb7894-b780-4298-a739-f6ef737f6028", "e8908df5-8b66-4953-9f6e-4a71f7f10d2e", "f677a190-fdf4-4e36-8670-8560547508cb" ], "restrict_access": false, "revoked": false, "scope": "report", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/", "tactics": [], "url": "https://attack.mitre.org/techniques/T1547/011/", "via_entities": [ { "id": "30b7da59-e563-4c5a-aba3-519efaf533c2", "name": "AMOS", "type": "Malware" } ] } ], "vulnerabilities": [] }, "report_id": "81884f53-7173-490b-8df7-1eb35c31231d", "schema_version": 1, "selected_date": "2026-09-16", "source_url": "https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/" }