Data Staging via ditto to /tmp (Amos Stealer)

Ethan Andrews@eandrews

•updated Jun 17, 2026•1•0•9

Detects the execution of the macOS 'ditto' command used to compress and stage files into the /tmp directory, specifically looking for the creation of zip archives. This behavior is associated with Amos Stealer prior to data exfiltration.