Why AMOS matters: The macOS malware stealing data at scale
2026-05-18T20:51:39Z•ffca02457ad54cdd4dc8be36a9736bce491678b94cac789db549f84c2cc799a3
AIAMOSCVEsDLL sideloadingGPT-5.5MicrosoftPatch Tuesdaybackdooridentity securityinfostealermacOSransomwaresupply chain
What happened
Sophos published multiple threat-research and product posts in May 2026 highlighting active macOS threat activity, a large Microsoft Patch Tuesday, AI-related operational risks, and supply-chain/backdoor incidents. Key items: Sophos X‑Ops details the Atomic macOS Stealer (AMOS) — an infostealer targeting macOS and exfiltrating data at scale; May’s Patch Tuesday disclosed 132 Microsoft CVEs (combined advisories approach ~300); a malicious imitation of Anthropic’s Claude site ("Donuts and Beagles") uses DLL sideloading to deliver a backdoor; Sophos Endpoint demonstrated blocking of a novel suply
Why it matters
A reviewed impact interpretation has not been published for this record.
Evidence and limitations
- Source ID
- sophos_news
- Record identifier
- ffca02457ad54cdd4dc8be36a9736bce491678b94cac789db549f84c2cc799a3
- Enrichment time
- 2026-05-18T20:51:39Z
- AI-assisted enrichment
- Yes
This record may overlap with other records. Its enrichment can be incomplete or wrong, and machine assistance was used. Validate consequential decisions against the linked source and your own environment.