Amos Stealer Artifact Cleanup Detection

Ethan Andrews@eandrews

•updated Jun 17, 2026•2•0•6

Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.