A pasted Terminal command that quietly empties a Mac: Keychain, browser sessions, and crypto wallets, then stays resident. Reverse-engineered, attributed, and turned into detections.
What it is, who runs it, and why it matters.
The captured command is the first stage of a macOS information stealer delivered through the ClickFix social-engineering technique: a fake Cloudflare "Verify you are human" page that tricks the victim into pasting a command into Terminal.
It is not nation-state APT activity. It is financially-motivated eCrime: an affiliate of a macOS infostealer Malware-as-a-Service operation in the Atomic macOS Stealer (AMOS) / Odyssey lineage.
The objective is theft of credentials, browser sessions, Keychain secrets, and cryptocurrency wallets, then system-level persistence for resale and long-term access. The whole chain after the paste is autonomous: the victim only pastes the command and types a password into a fake prompt.
For a developer-heavy org with cloud and crypto exposure, treat any confirmed execution as a credential-compromise incident: rotate everything reachable from that host, including AWS keys and SSO sessions.
Indicators confirmed for this sample. Block and hunt these now. Click an icon to copy.
VirusTotal note: the report you linked is the URL analysis for api.ketoriloxisd[.]com/GpZcowV4DCvwthe1. Confirmed: the SHA-256 of that URL equals the VT identifier 9ecdf6a4...a5ea2e73. Live vendor verdicts could not be read from this environment (the VT page is JavaScript-rendered); check the live page before quoting a detection count.
How it unfolds. Teal = a human must act. Amber = the malware acts alone. Click any phase to expand.
Tactics and techniques observed across the chain. Hover any technique for detail.
Confirmed indicators, related-cluster indicators (broad hunting only), and behavioral IOAs.
Mapped with the applicable security tooling. ● primary ● indirect ● delivery vector ● config only
Queries contain live indicator strings so they actually match. Adjust field names to your schema.
The AMOS / Odyssey cluster and the 2026 shift to signature-gated loaders. Each card links to source.
What the operator was trying to achieve.
Monetize the victim. Drain crypto wallets directly, resell credentials and live browser sessions on stealer markets, and keep a persistent foothold for re-infection or follow-on intrusion into corporate cloud and SaaS.
Containment and recovery, in order. Preserve evidence before you wipe.
One sibling family (MioLab) was distributed via a cloned Claude Code documentation site. Your org runs Claude Enterprise and Bedrock, and your engineers are exactly the developer audience these lures target. Worth a focused watch on typosquats of your AI and dev tooling.
You hold the access key and download secret. In a sanctioned, legal-cleared exercise these could fingerprint the operator delivery infra, but doing so actively touches attacker servers and must route through IR and legal first.
Wrap section 06 into an n8n flow: schedule the S1 and Sumo queries, auto-block new ketoriloxisd-style domains via DNS Firewall, and open a ticket on any hit.
For internal defensive use. Analysis of attacker-delivered code for detection engineering and incident response. No malware was executed in producing this brief.