The Bybit team used AI to monitor the Amos malware release campaign.

The Bybit team used AI to detect Amos malware release campaigns until penetrating with reverse engineering methods.

Since Claude Code became the point of the source code being leaked, this artificial intelligence tool has been impersonated for the release of a lot of malware, but this time the malware that claims the AI name is about to be penetrated by another AI.

According to a report by the PR Newswire website, the Security Operations Center (SOC) of the famous Crypto Curren C (Exchange) trading provider website Bybit has brought in AI tools to monitor the AMOS malware release campaign, a malware type that steals data from the victim's machine, or an Infostealer that is headed to attack users of the macOS operating system. The use of AI tools to monitor the malware campaign is called "Re-Engineering," which can reach the infrastructure of the C2 control system. Command and Control, File Signature, Behavior Pattern, Malware Lifecycle, Intrusion Indicators (IOC) are all achieved within 40 minutes, shortening the traditional monitoring period by at least 6 to 8 hours. Bybit says that the new system allows teams to deal with intrusions from the wrong to 70% more sensitive than traditional ones.

For this round of AMOS malware distribution campaigns, Bybit has revealed that hackers have used a search poisoning method, SEO Poisoning, that causes those searching for Claude Code to find fake websites of hackers as the top of their search. In the fake website, there are many decorations that make them look credible, such as documents about AI tools similar to real websites, to lure victims into downloading fake application files that act as drippers. This leads to 2-step embedding of malware.

First, the Mach-O file format dropper runs osascript scripts to embed Infostealer malware like Amos (sometimes Banshee) on the machine, followed by multi-phase Obfuscation to steal important data such as passwords, codes saved on macOS Keychain, Telegram chat application access, VPN usage profile (Virtual Private Network), and Cryptokerrency wallet (Wallet). This malware can steal wallet data. It works as an extension of up to 250 web browsers.

The second step is to release another payload file, a backdoor type of malware written in C + + language that comes with a high level of detecting ability, including a system to detect if the malware is running on Sandbox Detection and Encryption. In part of the Runtime settings of the malware, this malware creates its own persistence on the system at any time, and then makes contact with the HTTP protocol, allowing hackers to remotely control the system. Yeah.

# Trending # Lemon 8 Howtoo # lemon 8 diary # bybit # freedomhack