Amos Stealer Post-Exfiltration Cleanup Deleting /tmp/osalogging.zip and /tmp/sync

Ibrahim Saud@tektrix

•updated Jun 24, 2026•1•0•5

Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.