Universal Mach-O binary consistent with AMOS stealer payload
Detects a universal (fat) Mach-O binary containing both x86_64 and arm64 architecture slices, within a specific file size range (500KB to 20MB). This signature matches the final-stage payload observed in the fake OpenAI Codex ClickFix campaign associated with the Atomic macOS Stealer (AMOS) malware.
YARA
