AMOS Stealer: Fake com.apple.accountsd.helper LaunchAgent Persistence

Duo Tech@duotech

•updated Aug 4, 2026•1•0•10

Detects creation or modification of files under hidden, Apple-mimicking Application Support directories (.com.apple.accountsd, .com.apple.metadata.mds) that back a masquerading LaunchAgent -- the persistence mechanism AMOS stealer uses to survive reboot as AccountsHelper/mdworker_shared.