AMOS Stealer C2 Tasking Beacon over Non-Standard TCP Port

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•0

Detects network traffic associated with AMOS (Atomic macOS) Stealer malware, identifying C2 beaconing and tasking requests. The rules specifically monitor POST requests to '/api/t' with JSON payloads and GET requests to '/api/shell/agent' over non-standard ports (excluding 80 and 443).