Mac.c stealer challenges AMOS: A new rivalry in the macOS infostealer market

Moonlock by MacPaw has analyzed a new macOS infostealer called Mac.c, developed by mentalpositive and apparently learning techniques from the AMOS infostealer. This actor has opted for open development on darknet forums, which accelerates the proliferation of variants and makes it easier for other criminals to adopt the code or adapt its modules.

Mac.c operates as a classic information stealer but with a modular design and attention to evasion. Its reported functions include enumerating browsers to steal cookies and credentials, extracting macOS keychains when possible, searching for digital wallets and SSH keys, collecting system information, and temporarily storing data before exfiltration to command and control servers. It uses persistence mechanisms such as LaunchAgents and packers to make detection by basic tools more difficult.

Public construction on darknet forums facilitates the creation of builders, additional modules, and obfuscation techniques that reduce the need for advanced knowledge among imitators. This dynamic represents a greater risk for businesses and end users in the macOS ecosystem, as it encourages the rapid emergence of new variants and distribution campaigns through phishing and trojanized executables.

Operational recommendations to mitigate the threat include keeping macOS updated, enabling Gatekeeper and XProtect, applying endpoint detection and response solutions, using multi-factor authentication on critical accounts, protecting keychains and password managers, segmenting networks, and monitoring outbound traffic to detect communications with suspicious C2 infrastructure. Additionally, it is key to conduct periodic threat analysis, penetration testing, and a refined incident response plan to reduce the impact of an infection.

At Q2BSTUDIO, we are a custom software and application development company specialized in artificial intelligence, cybersecurity, and AWS and Azure cloud services. We offer comprehensive services including security audits, managed detection and response, custom software development, and business intelligence solutions to help companies protect their digital assets against threats like Mac.c.

Our capabilities in artificial intelligence and AI for businesses allow us to create custom AI agents, automate anomaly detection, and improve the correlation of security events. We also implement Power BI dashboards to visualize risk indicators and security metrics, and develop secure integrations with AWS and Azure cloud services for production environments.

If you need cybersecurity consulting, custom software development, business intelligence services, or implementation of AI agents and Power BI solutions, Q2BSTUDIO provides consulting, custom developments, and ongoing support to reduce risks and improve your organization's resilience against emerging threats.