AMOS: Sequential TCC prompts for Finder/Notes/Desktop/Documents via Terminal

Keith D@KeithD

•updated Sep 17, 2026•0•0•5

Detects sequential Transparency, Consent, & Control (TCC) permission prompts triggered by the 'Terminal' application within a 5-minute window. This behavior is indicative of the AMOS (Atomic macOS) Stealer automating the collection of unauthorized permissions to access sensitive system locations such as Finder, Desktop, Documents, and Notes.