Back to Intelligence

AMOS Stealer EtherHiding C2, EKZ Stealer via Fortinet CVE-2026-35616 & RecruitTrap OAuth Phishing: OTX Pulse Analysis — Enterprise Detection Pack

SA
Security Arsenal Team
August 26, 2026
9 min read

Threat Summary

Three concurrent OTX pulses paint a clear picture of where credential-theft operations are heading in late 2026: socially-engineered initial access, abuse of legitimate platform trust, and evasion of infrastructure takedown.

  1. macOS ClickFix campaign (AMOS + XMRig) — Victims are lured to fake CAPTCHA verification pages and tricked into pasting malicious AppleScript into Terminal. The chain installs Atomic macOS Stealer (AMOS) for browser/keychain credential theft and drops XMRig for resource monetization. Critically, the C2 address is stored in a Polygon blockchain smart contract (EtherHiding), meaning the infrastructure cannot be sinkholed by seizing a domain — defenders must treat the delivery domains (citcix6.xyz, sj98xe4.xyz, etc.) as disposable and focus on behavior.

  2. EKZ Stealer via CVE-2026-35616 — In May 2026, actors exploited an improper access control flaw in Fortinet EMS 7.4.5–7.4.6 to deploy EKZ Stealer inside an energy-sector organization. The payload masqueraded as FortiEndpoint_Patch.exe, harvested credentials from Chromium browsers and Firefox, and exfiltrated via PowerShell to http://83.138.53.110/service/save.php. The sample is protected by control-flow flattening, indicating an obfuscating compiler toolchain designed to defeat static analysis.

  3. RecruitTrap recruitment phishing — Actors impersonate HR staff from major brands (HBC, FIFA, McKinsey, American Airlines, Levi's, Expedia) using lookalike *-careers.com domains. Desktop victims see Browser-in-the-Browser fake login windows; mobile victims see full-screen credential pages with no URL bar. The kit filters out personal email addresses to harvest enterprise credentials and OAuth tokens across aerospace, technology, retail, finance, hospitality, manufacturing, and media.

Collectively: credential theft remains the primary monetization path, initial access is shifting from exploit-heavy to human-layer techniques, and adversaries are engineering resilience into C2 (blockchain) and payloads (flattening obfuscation).

Threat Actor / Malware Profile

AMOS (Atomic macOS Stealer) + XMRig ClickFix Kit

  • Distribution: ClickFix social engineering — fake CAPTCHA/verification pages instruct victims to run a copied AppleScript command in Terminal.
  • Payload behavior: AMOS enumerates and exfiltrates browser credentials, cookies, crypto wallets, and keychain material; XMRig is dropped for Monero mining on compromised hardware.
  • C2 communication: EtherHiding — C2 URLs are read from Polygon blockchain smart contracts at runtime, then resolved through rotating low-reputation TLDs (.xyz, .site, .pro, .click, .baby).
  • Persistence: LaunchAgent-based persistence installed by the AppleScript chain (backdoor agent survives reboot).
  • Anti-analysis: Blockchain indirection defeats IOC-based blocking; script-based delivery minimizes on-disk artifacts.

EKZ Stealer

  • Distribution: Post-exploitation deployment via Fortinet EMS CVE-2026-35616 (improper access control), delivered as a fake patch: FortiEndpoint_Patch.exe.
  • Payload behavior: Harvests stored credentials from Chromium-based browsers and Firefox.
  • C2 communication: PowerShell-driven HTTP POST exfiltration to a raw-IP PHP endpoint (/service/save.php) — no domain, no TLS.
  • Persistence: Not confirmed in the pulse; hunt for Run keys and scheduled tasks created around execution time.
  • Anti-analysis: Control-flow flattening via an obfuscating compiler; eSentire's analysis required Binary Ninja workflows to deobfuscate.

RecruitTrap Kit

  • Distribution: Recruitment-themed phishing impersonating corporate HR; lookalike *-careers.com infrastructure.
  • Payload behavior: Credential + OAuth token capture; Browser-in-the-Browser fake IdP windows on desktop, chromeless full-screen pages on mobile.
  • Victim filtering: Rejects personal email domains to ensure only enterprise credentials are captured — a hallmark of operations feeding initial-access-broker pipelines.

IOC Analysis

Indicator types in these pulses:

  • Domains (ClickFix/AMOS): citcix6.xyz, sj98xe4.xyz, hf98x4d.site, xuiaxwx.com, gesck4m.pro, apdhlhs3.xyz, okekjaiw.click, 8jdjpwka.baby — short-lived delivery/staging domains. Block at DNS/proxy, but assume replacement within hours; pair with behavior detections.
  • Domains (RecruitTrap): hbc-careers.com, fifahr-careers.com, mckinsey-careers.com, aa-careers.com, levis-careers.com, andmore-global.com, expedia-careers.com — plus a wildcard rule for *-careers.com patterns resolving to recently registered infrastructure.
  • IP/URL (EKZ): 83.138.53.110 and http://83.138.53.110/service/save.php — raw-IP HTTP exfil is high-fidelity; alert on any egress to this host and on PowerShell web requests to non-standard IP destinations generally.
  • File hashes (EKZ): SHA256 0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e, MD5 338662fd0c4d750a0ba203a32b59f081, SHA1 17e771c78430cc67e71d4547f8996a1a488e9d3f — push to EDR block lists; note obfuscated recompilation will change hashes, so filename + behavior detection is essential.
  • CVEs: CVE-2026-35616 (Fortinet EMS 7.4.5–7.4.6 improper access control — patch immediately), plus CVE-2026-16232 and CVE-2026-18577 flagged in the same report for triage.

Operationalization: Feed domains/IPs into DNS filtering and proxy blocks; hashes into EDR reputation and execution prevention; CVEs into vulnerability management with emergency change windows. Because AMOS resolves C2 via Polygon smart contracts, monitor for hosts querying public Polygon RPC endpoints (e.g., polygon-rpc.com, *.polygon.technology) from non-wallet processes.

Detection Engineering

YAML
---
title: EKZ Stealer PowerShell HTTP Exfiltration to Raw IP
description: Detects PowerShell web requests posting data to raw IP addresses, matching EKZ Stealer exfiltration to /service/save.php observed in Fortinet EMS CVE-2026-35616 intrusions.
author: Security Arsenal
status: experimental
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_powershell:
    Image|endswith:
      - '\powershell.exe'
      - '\pwsh.exe'
  selection_cmd:
    CommandLine|contains:
      - 'Invoke-WebRequest'
      - 'Invoke-RestMethod'
      - 'System.Net.WebClient'
      - 'UploadData'
      - 'UploadFile'
  selection_exfil:
    CommandLine|contains:
      - '/service/save.php'
      - '83.138.53.110'
  condition: selection_powershell and selection_cmd and selection_exfil
falsepositives:
  - Legitimate admin scripts (rare for raw-IP PHP endpoints)
level: high
tags:
  - attack.exfiltration
  - attack.t1041
---
title: Fake Fortinet Patch Binary Execution - EKZ Stealer Delivery
description: Detects execution of FortiEndpoint_Patch.exe or EKZ Stealer hashes, the dropper used in energy-sector intrusions following CVE-2026-35616 exploitation.
author: Security Arsenal
status: experimental
date: 2026/08/26
logsource:
  category: process_creation
  product: windows
detection:
  selection_name:
    Image|endswith: '\FortiEndpoint_Patch.exe'
    OriginalFileName: 'FortiEndpoint_Patch.exe'
  selection_hash:
    Hashes|contains:
      - '0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e'
      - '338662fd0c4d750a0ba203a32b59f081'
      - '17e771c78430cc67e71d4547f8996a1a488e9d3f'
  filter_signed:
    Company: 'Fortinet, Inc.'
  condition: (selection_name or selection_hash) and not filter_signed
falsepositives:
  - Genuine Fortinet patching (signed binaries filtered)
level: critical
tags:
  - attack.initial_access
  - attack.t1036
  - attack.credential_access
---
title: macOS ClickFix AppleScript Execution and LaunchAgent Persistence (AMOS)
description: Detects suspicious osascript execution followed by LaunchAgent plist creation, matching the AMOS Stealer ClickFix infection chain with EtherHiding C2.
author: Security Arsenal
status: experimental
date: 2026/08/26
logsource:
  product: macos
  category: process_creation
detection:
  selection_osascript:
    Image|endswith:
      - '/osascript'
      - '/bash'
      - '/zsh'
  selection_cmd:
    CommandLine|contains:
      - 'do shell script'
      - 'curl'
      - 'LaunchAgents'
      - 'base64'
  condition: selection_osascript and selection_cmd
falsepositives:
  - MDM provisioning scripts; developer automation
level: high
tags:
  - attack.execution
  - attack.t1059
  - attack.persistence
  - attack.t1543.001
KQL — Microsoft Sentinel / Defender
// Security Arsenal Hunt: EKZ C2, ClickFix delivery domains, RecruitTrap phishing infrastructure
let EkzC2 = dynamic(["83.138.53.110"]);
let ClickFixDomains = dynamic(["citcix6.xyz","sj98xe4.xyz","hf98x4d.site","xuiaxwx.com","gesck4m.pro","apdhlhs3.xyz","okekjaiw.click","8jdjpwka.baby"]);
let RecruitTrapDomains = dynamic(["hbc-careers.com","fifahr-careers.com","mckinsey-careers.com","aa-careers.com","levis-careers.com","andmore-global.com","expedia-careers.com"]);
union isfuzzy=true
(DeviceNetworkEvents
| where TimeGenerated > ago(30d)
| where RemoteIP in (EkzC2)
   or RemoteUrl in~ (ClickFixDomains)
   or RemoteUrl in~ (RecruitTrapDomains)
   or RemoteUrl endswith "-careers.com"
| project TimeGenerated, DeviceName, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, RemoteIP, RemoteUrl, RemotePort),
(DeviceProcessEvents
| where TimeGenerated > ago(30d)
| where FileName =~ "FortiEndpoint_Patch.exe"
   or ProcessCommandLine has_any ("/service/save.php", "83.138.53.110")
   or (FileName =~ "powershell.exe" and ProcessCommandLine has_any ("Invoke-WebRequest","Invoke-RestMethod","UploadData") and ProcessCommandLine matches regex @"https?://\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}")
   or (FileName =~ "osascript" and ProcessCommandLine has_any ("do shell script","curl","base64"))
| project TimeGenerated, DeviceName, AccountName, FileName, ProcessCommandLine, SHA256, FolderPath)
| order by TimeGenerated desc
PowerShell
# Security Arsenal IOC Hunt — EKZ Stealer / AMOS ClickFix artifacts (Windows endpoints)
# Run elevated via your RMM/EDR across the fleet.

$Report = @()

# 1. EKZ Stealer hash sweep in common staging dirs
$TargetHash = '0da123adf9251957a4b850a3f6bd6a753dd4892be176a84a18450e899534cc5e'
$Paths = @("$env:TEMP","$env:APPDATA","$env:LOCALAPPDATA","C:\ProgramData","C:\Users\Public")
foreach ($p in $Paths) {
    Get-ChildItem -Path $p -Recurse -File -Include *.exe -ErrorAction SilentlyContinue | ForEach-Object {
        if ((Get-FileHash $_.FullName -Algorithm SHA256 -ErrorAction SilentlyContinue).Hash -eq $TargetHash) {
            $Report += [pscustomobject]@{Check='EKZ_Hash'; Finding=$_.FullName}
        }
    }
}

# 2. Fake patch binary by name
Get-ChildItem -Path $Paths -Recurse -Filter 'FortiEndpoint_Patch.exe' -ErrorAction SilentlyContinue |
  ForEach-Object { $Report += [pscustomobject]@{Check='FakePatch_Name'; Finding=$_.FullName} }

# 3. Live/historical connections to EKZ C2
Get-NetTCPConnection -ErrorAction SilentlyContinue |
  Where-Object { $_.RemoteAddress -eq '83.138.53.110' } |
  ForEach-Object { $Report += [pscustomobject]@{Check='EKZ_C2_Connection'; Finding="$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort) [$($_.State)] OwningPID=$($_.OwningProcess)"} }

# 4. Persistence: Run keys referencing patch/stealer artifacts
$RunKeys = 'HKLM:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run','HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'
foreach ($k in $RunKeys) {
    (Get-ItemProperty $k -ErrorAction SilentlyContinue).PSObject.Properties |
      Where-Object { $_.Value -match 'FortiEndpoint|AppData.*\.exe|ProgramData.*\.exe' } |
      ForEach-Object { $Report += [pscustomobject]@{Check='RunKey_Persistence'; Finding="$k :: $($_.Name) = $($_.Value)"} }
}

# 5. Suspicious scheduled tasks created in the last 30 days running unsigned EXEs from user dirs
Get-ScheduledTask -ErrorAction SilentlyContinue | ForEach-Object {
    $act = $_.Actions | Where-Object { $_.Execute -match 'AppData|ProgramData|Temp' }
    if ($act -and $_.Date -gt (Get-Date).AddDays(-30)) {
        $Report += [pscustomobject]@{Check='Suspicious_ScheduledTask'; Finding="$($_.TaskName) -> $($act.Execute)"}
    }
}

# 6. PowerShell exfil evidence in event log (Script Block / process creation to raw IPs)
Get-WinEvent -FilterHashtable @{LogName='Microsoft-Windows-PowerShell/Operational'; Id=4104; StartTime=(Get-Date).AddDays(-14)} -ErrorAction SilentlyContinue |
  Where-Object { $_.Message -match '83\.138\.53\.110|/service/save\.php|Invoke-WebRequest.*http://\d' } |
  ForEach-Object { $Report += [pscustomobject]@{Check='PS_Exfil_Log'; Finding=$_.Message.Substring(0,[Math]::Min(200,$_.Message.Length))} }

if ($Report) { $Report | Format-Table -AutoSize; $Report | Export-Csv ".\EKZ_AMOS_Hunt_$(hostname)_$(Get-Date -Format yyyyMMdd).csv" -NoTypeInformation }
else { Write-Output '[+] No EKZ/AMOS artifacts found on this host.' }

Response Priorities

Immediate (0–4 hours):

  • Block all listed ClickFix and RecruitTrap domains at DNS/proxy; block egress to 83.138.53.110; push the EKZ SHA256/MD5/SHA1 to EDR execution prevention.
  • Hunt for FortiEndpoint_Patch.exe execution and PowerShell raw-IP web requests fleet-wide using the queries above.
  • Emergency-patch Fortinet EMS 7.4.5–7.4.6 against CVE-2026-35616; verify EMS management interfaces are not internet-exposed.
  • Alert macOS users on the ClickFix lures: legitimate CAPTCHA pages never ask you to paste commands into Terminal.

24 hours:

  • All three campaigns target credentials — assume compromise on any hit. Force password resets and revoke active sessions/OAuth tokens for affected identities; RecruitTrap specifically harvests OAuth tokens, so audit Entra ID/Okta token grants and revoke third-party app consents.
  • Review conditional access: enforce phishing-resistant MFA (FIDO2/passkeys) to neutralize harvested credentials.
  • Audit mobile endpoints for full-screen phishing page exposure; brief HR-adjacent staff on recruitment-themed lures.
  • On macOS endpoints, enumerate LaunchAgents/LaunchDaemons for unsigned plists created in the last 30 days and check for XMRig CPU signatures.

1 week:

  • Architecture hardening: restrict PowerShell egress (constrained language mode + proxy allow-listing), block raw-IP HTTP destinations at the perimeter, and restrict osascript/Terminal automation for standard users via MDM.
  • Deploy detection content above into production SIEM/SOAR with automated triage playbooks.
  • Stand up brand-monitoring for *-careers.com and executive-brand lookalike registrations; pre-approve takedown workflows.
  • Add Polygon-RPC egress monitoring for non-wallet processes to catch EtherHiding resolution behavior.

Related Resources

Security Arsenal Incident Response Managed SOC & MDR Services AlertMonitor Threat Detection From The Dark Side Intel Hub

darkwebotx-pulsedarkweb-credentialsamos-stealerekz-stealerrecruittrap-phishingclickfix-social-engineeringcredential-theft

Is your security operations ready?

Get a free SOC assessment or see how AlertMonitor cuts through alert noise with automated triage.

Book a SOC AssessmentSee AlertMonitor in Action