This week, Tanium’s Cyber Threat Intelligence (CTI) team investigates a malware campaign that uses cracked software to distribute the Atomic macOS Stealer (AMOS). Next, the team looks at TAG-150, a rapidly evolving threat actor which is deploying custom malware in sophisticated phishing and remote access operations. Finally, we wrap up with an overview of the GPUGate malware campaign that’s targeting IT firms in Western Europe.
AMOS Stealer campaign targets macOS
Trend Micro recently analyzed a malware campaign that uses cracked software to distribute AMOS and exfiltrate sensitive user data including credentials, crypto wallets, and system files.
According to Trend Micro, the attackers employ deceptive macOS Terminal commands and rotating domains to bypass security measures and maintain persistence on infected systems.
AMOS campaign overview
In this campaign, attackers are targeting macOS users with fake or “cracked” applications. Victims are tricked into downloading an installer for the desired application, which delivers the AMOS malware.
In some cases, users are being asked to copy and paste commands directly into their terminal to trigger the malware. Trend Micro points out how these attackers are using rotating URLs and domains so that the domain and download command changes with each visit to evade detection.
AMOS infection chain and delivery
- The attacker gains access to the system via fake application downloads that ultimately lead the victim to the landing page for AMOS.
- The victim will see a “download for macOS” option or instructions to run a command. In either case, a malicious installation script gets executed.
- This script downloads an AppleScript file and configures a LaunchDaemon to continuously run the script until the user logs in.
- When the user logs in, the hidden binary runs to establish persistence. This script will gather data including username and password, browser data, keychain data, and much more, compressing it to a ZIP and exfiltrating it.
Insights from MDR
Trend Micro’s Managed Detection and Response (MDR) team observed the sequence of events starting with suspicious process activity, credential theft tasks, and data exfiltration. This enabled a more thorough investigation.
The first alert they observed caught the extraction of login data from web browsers, copying Chrome’s Login Data SQLite file that stores credentials. The second alert was for a script to steal data including browser credentials and files from common browsers. This also gathered system profiler information.
Initial access
Trend Micro determined that AMOS was delivered to the device as a download of cracked software, as many of the users that were impacted had visited the same site multiple times that hosted various fake software applications specifically for macOS.
The impacted users had searched for and downloaded “CleanMyMac” on their machines. Clicking the download button led users to the AMOS landing page. After clicking, users were redirected, and the redirect destination changes with each visit along with the URL embedded in the command.
How victims install AMOS
Victims have two ways to install AMOS. The first method involves clicking on the download button which will load a .dmg file along with installation instructions. The other method asks the victim to copy, paste, and execute a malicious command.
- For the first method, Installer_v.2.13.dmg downloads and the version number changes. The file displays instructions for the victim to right-click and open it. Trend Micro notes that Gatekeeper intervened in this case because of the version of macOS running, blocking the malware before it could complete its compromise.
- The second method, which has a better success rate, asks victims to execute a command directly. When this is executed, AMOS gets installed on the host. The victim is then prompted with a “System Preferences” box which asks them to input their password repeatedly until the correct password is entered. An additional script will then check if it is running in a virtualized environment, exiting if so. After these checks the malware will exfiltrate data, establish persistence, and hide terminal windows and manipulate system files and apps.
Analyst comments from Tanium’s Cyber Threat Intelligence team
The use of cracked software as a delivery vector is a reminder that threat actors often exploit convenience, making it essential for organizations to monitor and restrict access to unauthorized software repositories.
The broad data theft capabilities of the AMOS malware reflect a growing trend in macOS targeted malware. Further, the attackers’ use of rotating domains and obfuscated scripts demonstrates a high level of operational agility, making traditional signature-based detection insufficient and highlighting the value of behavior-based threat detection.
TAG-150 deploys new CastleRAT malware
A recent report from Recorded Future details TAG-150, which is a rapidly evolving threat actor. This actor has developed a multi-tiered infrastructure and a suite of custom malware, including the newly discovered CastleRAT, to conduct sophisticated phishing and remote access operations.
As Record Future explains, their campaigns leverage deceptive tactics and a broad toolset to target victims while actively adapting to public exposure and defensive measures.
Who is TAG-150?
Recorded Future uses TAG-150 to refer to the actor linked to the “development and use of the malware families CastleLoader, CastleBot, and, more recently, CastleRAT.”
Recorded Future has been observing TAG-150 since March 2025. According to their research, many of the infections start with ClickFix style attacks or fake GitHub repos that pretend to be legitimate applications. The group is believed to operate a malware-as-a-service (MaaS) model to deliver a range of second-stage payloads.
TAG-150 infrastructure analysis
Recorded Future shared details of the actor’s multi-tiered infrastructure:
- Tier 1: The Tier 1 infrastructure contains several C2 servers for different malware families like CastleLoader, CastleRAT, and others. These servers are managed via Tier 2 servers.
- Tier 2: Tier 2 consists of VPS servers that are believed to function “as intermediaries between victim-facing Tier 1 servers and the Tier 3 infrastructure.” The actor is known to access these servers via RDP before connecting to the Tier 1 servers. In many instances, Recorded Future observed the actor bypassing Tier 2 and connecting to Tier 1 servers from Tier 3 infrastructure.
- Tier 3: In Tier 3, researchers identified VPS servers that all used the same TLS cert, with one likely acting as the hub. They also identified a residential Russian IP address that communicated with servers in both Tier 1 and Tier 2, which they believe could be the work of a second operator.
- Tier 4: The main server from Tier 3 communicates with a potential backup server in Tier 4. The communication occurred over a “persistent high-port-to-high-port UDP session spanning several weeks.”
CastleRAT’s Python and C variants
The CastleRAT malware has both a Python variant and a C variant. Both variants use a custom binary protocol, query a geolocation API, download executables, and offer remote shell capabilities.
According to Recorded Future, the C variant of the malware comes with a keylogger, clipper, capabilities for screen capture, file manipulation, shell commands, and more.
Analyst comments from Tanium’s Cyber Threat Intelligence team
TAG-150’s operational agility is evident in its rapid malware iteration and infrastructure adaptation, suggesting that the group is both well-resourced and technically capable.
Their use of multi-tiered infrastructure and custom malware like CastleRAT reflects a shift from commodity tooling to custom solutions which could indicate that this group is maturing.
GPUGate targets IT firms in Western Europe
According to Arctic Wolf, the GPUGate malware campaign is using Google Ads and GitHub commit links to trick IT professionals into downloading a trojanized GitHub Desktop installer that activates exclusively on systems with real GPUs, evading traditional sandbox detection.
Arctic Wolf's analysis also reveals advanced evasion techniques. The attackers have native Russian language proficiency and are targeting Western Europe with a highly selective and stealthy approach.
GPUGate initial infection vector
The attack starts with malvertising, using a sponsored Google Ad at the top of Google search results that looks like a legitimate site for GitHub desktop.
The actor created a commit in a legitimate GitHub repository and then modified the README so it contained malicious download links. Arctic Wolf notes that an actor could embed the malicious hash into the page’s URL so that a page that looks just like the original repository is shown, but with the README containing the malicious links.
The page shows legitimate data because the commit is real, making it harder for victims to identify it as malicious. The “only indication that the page is a single commit view is a small banner at the top stating that the visitor is viewing a specific commit, rather than the repository’s default branch.” The attacker takes it a step further by adding an anchor to the link, so the victim is led to the bottom of the commit page where the malicious content is.
The malicious download links remove the victim from GitHub to a malicious gitpage[.]app.
Second stage: GitHubDesktopSetup-x64.exe
The malware is downloaded as GitHubDesktopSetup-x64.exe. The file is large to match what the true GitHub Desktop installer would look like.
The creator of the malware also edited the header of the malware to prevent file extraction. The MSI file contains 171 executables, most of which are benign files to make analysis more difficult. However, Arctic Wolf notes that at least one is malicious.
The malware will perform checks to exclude devices that don’t meet the hardware requirements it has established. One such check looks at the length of the device name, as VMs often have shorter or generic names while legitimate GPUs typically have longer ones.
GPUGate features
Arctic Wolf calls out some of the more notable features of GPUGate:
- For stealthy execution, the PowerShell will launch with certain parameters to hide windows from the user and bypass execution policies.
- To establish persistence, it creates a scheduled task that launches at reboot.
- For defense evasion, it will exclude Defender malware storage locations from scanning, so its malicious components are not identified.
- For C2, it uses several redundant domains and IP addresses, so it can continue to operate even if one is taken down.
The malware gathers and exfiltrates sensitive data from local file systems. Arctic Wolf notes that GPUGate may be capable of deploying ransomware and deleting backup files to and system recovery options.
Analyst comments from Tanium’s Cyber Threat Intelligence team
By requiring a real GPU for decryption, GPUGate marks a shift toward environment-aware malware, making traditional sandboxing and automated analysis far less effective.
This campaign not only targets systems with GPUs, but also users that are likely to have elevated privileges. This implies some level of pre-attack profiling which could be part of a broader attack strategy.
During their research, Arctic Wolf observed that one of the attacker-controlled sites also served the macOS AMOS stealer. The potential link to AMOS elevates this threat.
Do you have insight into these stories that you want to share? Head over to Tanium’s discussion forum to start a conversation.
For further reading, catch up on our recent cyber threat intelligence roundups.