AMOS - MainHelper Backdoor Dropper (T1105)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•2

Correlates the downloading of the secondary Mach-O backdoor (.mainhelper) into the user's home directory as a hidden file.