Malware

unix32385485

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

The attackers hosted the page on Google Sites, leveraging the trusted appearance of sites.google.com to lower users’ guard. The first part of the page mimicked a community application form... users were redirected to a fake security verification page.

Execution

3 techniques

T1059.002AppleScriptEvidence1

tricking users into downloading a .scpt file or copying and executing a Terminal command.

T1059.004Unix ShellEvidence1

The command used in the local records was wrapped in Base64 and then executed through base64 -d | bash.

T1204User ExecutionEvidence1

The attackers provide two options: the recommended method of downloading a .scpt file, or manually installing through a Terminal Command.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

Sensitive strings within the sample — including file paths, shell commands, and C2 server addresses — are not stored in plaintext. Instead, they are embedded as encrypted blocks in the __const section and decrypted individually at runtime.

T1036MasqueradingEvidence1

The attackers impersonated technical prompts related to api_error_401, OAuth 2.0, and macOS security verification... The attackers use a blue Google-style header, the error name api_error_401, technical terms such as OAuth 2.0, openid, profile, email, and 401 Unauthorized...

T1070.004File DeletionEvidence1

After the upload is completed, the sample deletes the temporary directory and archive file: rm -rf /tmp/lksopo rm -f /tmp/lksopo.zip

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

Its primary targets include browser credentials and cookies... The sample attempts to copy Safari cookies from the following locations... Cookies.binarycookies

T1555Credentials from Password StoresEvidence1

The sample copies the macOS login Keychain database: ~/Library/Keychains/login.keychain-db

T1555.003Credentials from Web BrowsersEvidence1

These directories typically contain login credentials, cookies, Local Storage data, browser extension data, and session information.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

The sample first reads the USER environment variable and checks whether the current user is root.

T1082System Information DiscoveryEvidence1

The system information collection commands include: sw_vers -productVersion | cut -d. -f1 ... system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

T1083File and Directory DiscoveryEvidence1

It also traverses directories associated with Chromium- and Gecko-based browsers... The wallet targets identified from the decrypted strings include: Electrum, Electrum-LTC, Coinomi, Exodus...

Collection

1 technique

T1560Archive Collected DataEvidence1

It then uses ditto to package the collected data: ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The data is then uploaded to the C2 server via an HTTP POST request.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

medium slowmistNews

Jul 13, 2026

Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware | by SlowMist | Jul, 2026 | Medium

A macOS Universal Mach-O payload delivered by the phishing campaign. The sample steals browser data, Keychain contents, Notes, Telegram Desktop data, and cryptocurrency wallet data, and appears highly consistent with an AMOS variant.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Back to malware

Malware

unix32385485

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

MITRE ATT&CK

Techniques & procedures

15 distinct techniques documented for this family, organized by ATT&CK tactic.

Initial Access

1 technique

T1566PhishingEvidence1

Execution

3 techniques

T1059.002AppleScriptEvidence1

tricking users into downloading a .scpt file or copying and executing a Terminal command.

T1059.004Unix ShellEvidence1

The command used in the local records was wrapped in Base64 and then executed through base64 -d | bash.

T1204User ExecutionEvidence1

The attackers provide two options: the recommended method of downloading a .scpt file, or manually installing through a Terminal Command.

Stealth

3 techniques

T1027Obfuscated Files or InformationEvidence1

T1036MasqueradingEvidence1

T1070.004File DeletionEvidence1

After the upload is completed, the sample deletes the temporary directory and archive file: rm -rf /tmp/lksopo rm -f /tmp/lksopo.zip

Credential Access

3 techniques

T1539Steal Web Session CookieEvidence1

Its primary targets include browser credentials and cookies... The sample attempts to copy Safari cookies from the following locations... Cookies.binarycookies

T1555Credentials from Password StoresEvidence1

The sample copies the macOS login Keychain database: ~/Library/Keychains/login.keychain-db

T1555.003Credentials from Web BrowsersEvidence1

These directories typically contain login credentials, cookies, Local Storage data, browser extension data, and session information.

Discovery

3 techniques

T1033System Owner/User DiscoveryEvidence1

The sample first reads the USER environment variable and checks whether the current user is root.

T1082System Information DiscoveryEvidence1

The system information collection commands include: sw_vers -productVersion | cut -d. -f1 ... system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType

T1083File and Directory DiscoveryEvidence1

It also traverses directories associated with Chromium- and Gecko-based browsers... The wallet targets identified from the decrypted strings include: Electrum, Electrum-LTC, Coinomi, Exodus...

Collection

1 technique

T1560Archive Collected DataEvidence1

It then uses ditto to package the collected data: ditto -c -k --sequesterRsrc /tmp/lksopo /tmp/lksopo.zip

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence1

The data is then uploaded to the C2 server via an HTTP POST request.

ACTIVITY FEED

Recent activity

1 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

1 SOURCESView more in app

medium slowmistNews

Jul 13, 2026

Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware | by SlowMist | Jul, 2026 | Medium

What this page doesn’t show

The version that knows your environment.

Start free trial

IOC matching

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping15

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.