AMOS

Threat actors are using ClickFix-style social engineering lures to distribute a new remote access trojan (RAT) named ChainScript, which provides extensive remote control capabilities including command execution, file operations, screenshot capture, and cryptocurrency wallet theft. The malware uses a malicious Windows installer disguised as legitimate software (e.g., Spotify) to deploy a Node.js-based JavaScript agent via PowerShell and VBScript stages, establishing persistence through scheduled tasks and Registry Run keys. ChainScript employs a novel C2 discovery mechanism leveraging a Polygon blockchain smart contract to dynamically rotate WebSocket-based command-and-control infrastructure, enhancing resilience against takedowns. This campaign overlaps with another abuse of HBO Max's Reddit account, distributing macOS and Windows malware such as MacSync, Atomic Stealer, and Amatera Stealer under the PasteSwitch operation.

Threat actors are exploiting trusted AI platforms such as Claude, ChatGPT, and Grok by weaponizing shareable content features to distribute malware. Attackers created malicious Claude Artifacts and shared conversations that mimic legitimate software install guides or troubleshooting advice, hosted on the official domains of these platforms, to bypass user skepticism. These lures trick users into downloading SectopRAT, MacSync stealer, or AMOS stealer via malicious commands or redirects, leveraging the inherent trust in well-known domains. The campaigns are short-lived but effective, relying on SEO poisoning and sponsored search results to increase visibility.

A macOS-focused threat operation leveraging over 250 front-end domains employs browser fingerprinting to selectively serve malware lures to genuine Mac users while evading crawlers and sandbox environments. The fingerprinting script collects navigator properties, screen dimensions, WebGL signals, timezone, iframe detection, touch support, developer console activity, and codec capability checks to determine if the visitor is a real Mac user. Qualified users are presented with a fake GitHub-themed 'Download for macOS' page that delivers the Atomic Stealer (AMOS) infostealer via an obfuscated Terminal command. The command retrieves additional scripts from a /curl/<id> endpoint and executes payloads that target credentials, browser data, authentication stores, cryptocurrency wallets, and sensitive files.

The article details an active threat involving malicious AI agent skills used in supply chain attacks, specifically citing the ClawHavoc campaign which distributed the Atomic Stealer (AMOS) malware through compromised skills. These skills, which can execute scripts with developer privileges, have been found to contain malicious payloads capable of exfiltrating SSH keys and other sensitive data. The article also references the Miasma worm and Cline v2.3.0 compromise as part of a broader trend of attacks targeting AI coding agent ecosystems. Security teams are warned about the lack of visibility into skill inventories, enabling unchecked propagation of malicious or vulnerable skills across developer environments.

A macOS-targeted campaign dubbed 'Odyssey Stealer & AMOS' is actively distributing malware to developers through fake software download sites impersonating trusted platforms like Homebrew, TradingView, and LogMeIn. Attackers use social engineering tactics, including clipboard manipulation and base64-encoded commands, to trick users into executing malicious payloads. The campaign leverages reused infrastructure, including IP addresses and SSL certificates, to distribute stealer malware capable of harvesting system data, browser credentials, and cryptocurrency wallets.

ClickLock is a new macOS infostealer that uses social engineering via a fake Cloudflare CAPTCHA to trick users into pasting a malicious command into Terminal. Upon refusal to enter credentials, it initiates aggressive app-killing loops every 210ms to coerce compliance. It steals login passwords, browser credentials, crypto wallets, and Keychain data, exfiltrating via Telegram bots. The malware uses compromised websites for payload delivery and a modified open-source backdoor, with persistence via LaunchAgents.

OkoBot is a malware framework targeting Windows users, active since April 2025, that injects phishing pages into legitimate cryptocurrency wallet applications like Ledger Live and Trezor Suite to steal recovery phrases. One of its modules, SeedHunter, hooks into Electron-based apps and waits for hardware wallet connections before displaying a malicious recovery page. The framework uses trojanized software and phishing lures to gain access, establishes persistent remote access via SSH and RDP, and deploys multiple surveillance and data-stealing plugins. Kaspersky attributes the campaign to an unknown actor but notes Russian-language artifacts and targeting patterns.

OpenClaw's skill marketplace, ClawHub, has become a vector for AI supply chain attacks involving malicious skills that distribute infostealers, evade detection through file padding, and enable financial fraud via affiliate injection and front-running schemes. Multiple malicious skills were discovered between February and May 2026, leveraging paste-site redirects, C2 infrastructure, and dynamic payload delivery. These threats bypassed automated screening tools like VirusTotal and ClawScan, highlighting weaknesses in current detection mechanisms. Palo Alto Networks has collaborated with ClawHub and NVIDIA to improve skill verification and protect customers through advanced security services.