Data Staging and Compression via ditto (Amos Stealer)

Kaung Khant Ko@kaungkhantko

•updated Jun 17, 2026•0•0•4

This rule detects the use of the 'ditto' command-line utility on macOS for data staging and compression, specifically looking for executions that use compression flags (-c, -k) and target the /tmp/ directory. This behavior is indicative of information stealer malware like Amos Stealer, which may compress collected data before exfiltration.