AMOS Replacing Ledger Live or Trezor Suite in /Applications via cp or mv

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•2

Detects potential activity associated with the AMOS infostealer, where common terminal commands (cp or mv) are used to manipulate or replace legitimate Ledger Live or Trezor Suite cryptocurrency wallet applications located in the /Applications directory on macOS.