ThreatFox IOC Database

You are viewing the ThreatFox database entry for url http://178.128.253.92/api/metrics/run.

Database Entry

IOC ID:	1923815
IOC:	http://178.128.253.92/api/metrics/run
IOC Type :	url
Threat Type :	botnet_cc
Malware:	AMOS
Malware alias:	Atomic macOS Stealer
Confidence Level :	Confidence level is high (100%)
Is compromised? :	False
ASN:	AS14061 DIGITALOCEAN-ASN
Country:	US
First seen:	2026-09-18 06:00:46 UTC
Last seen:	never
UUID:	00e5f339-b322-11f1-8450-42010aa4000a
Reporter	c4ffeine
Reward	5 credits from ThreatFox
Tags:	Amos apph4 ClickFix Foxveil macOS
Reference:	https://www.virustotal.com/gui/file/158e11946bf88b2de4cabca7ea6b07dde9232c903a3925a60a3fd947bf1017b2

c4ffeine

Foxveil/AMOS 'apph4' exfil and telemetry endpoints, recovered from the decrypted stealer AppleScript (parent Mach-O f3b6962c49b361c63fe9d0af9a83e10a52133360117e4c8ac68272160a60edac). /contact takes the stolen archive as a multipart POST (-F "file=@..." plus l=, n=, p=1); /api/metrics/run takes the JSON stage beacon. Recovered from the sample, not observed in traffic: neither endpoint was contacted, because posting the build's own tokens would plant a fake victim in the operator's telemetry.