Outbound ipinfo.io TLS Lookup Following AMOS Stealer C2 Registration

Ibrahim Saud@tektrix

•updated Sep 26, 2026•0•0•0

This rule detects the two-stage network behavior of AMOS (Atomic macOS Stealer). First, it identifies the initial C2 registration beaconing to an '/api/t' endpoint. Subsequently, it monitors for an immediate follow-up TLS connection to 'ipinfo.io', which is commonly used by the malware for geolocation and victim system reconnaissance.