Amos Stealer ditto compression of stolen data into /tmp/osalogging.zip

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•3

Detects the use of the 'ditto' command with specific arguments indicating data staging or collection activities, particularly when archiving to a temporary location like '/tmp/osalogging.zip'. This could be indicative of an adversary collecting data from the local system before exfiltration.