AMOS Stealer User Context Pivoting

Ibrahim Saud@tektrix

•updated Jun 17, 2026•0•0•6

Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.