Amos Stealer SSH Keys and Dev Credentials Staged to /tmp/sync

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

Detects attempts to copy sensitive configuration or credential files (e.g., .ssh, .zshrc, .bash_history, .gitconfig, .kube, .aws) to a suspicious temporary directory '/tmp/sync' on macOS systems using common shell commands like 'cp', 'bash', 'zsh', or 'sh'. This activity could indicate an adversary staging data for exfiltration or further malicious use.