MALWARE-OTHER macOS AMOS disk image GAPIUpdate downloaded from GitHub

IPS-SWG

1 SID: 192339

Description

Detects payload download activity associated with the macOS AMOS disk image GAPIUpdate malware family.

Related blogs

The full-screen "Loading... Please wait." spinner page with its two dead Cancel and Continue buttons, alongside the fake "ShopEase" e-commerce storefront the page resolves into.

A Fake Security Locker, Delivered by Google Ads

September 14, 20266 min read

Shared beacon code that fingerprints the visitor (browser, OS, device, country), encrypts the record with ECDH P-256 and AES-GCM, and posts it to the collect endpoint

EtherHiding in the Browser: ClickFix Chain Ends in Amatera

August 25, 202612 min read

npm Stealer Reads Its C2 From an Ethereum Contract

August 4, 20265 min read

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

macOS ClickFix Lures Deploy AppleScript Stealer & Persistent RAT

June 17, 202611 min read

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

macOS ClickFix Campaign: AppleScript Stealers & New Terminal Protections

April 20, 20266 min read

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

RedTiger: New Red Teaming Tool in the Wild Targeting Gamers and Discord Accounts

October 23, 202510 min read

Cloud Threats Memo: Dropbox: Flexible Cloud Storage Increasingly Exploited by Attackers

July 26, 20222 min read

Hive Ransomware: Actively Targeting Hospitals

Hive Ransomware: Actively Targeting Hospitals

September 10, 20219 min read

Who Do You Trust? OAuth Client Application Trends

Who Do You Trust? OAuth Client Application Trends

June 15, 202110 min read

Cloud Threats Memo: Hard Times for ARM-based Mac M1 Processors

February 23, 20212 min read