# Aeternum

A C++ botnet loader and malware command-and-control operation that uses the Polygon blockchain to retrieve commands.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Atomic macOS (AMOS) Stealer Activity

DevFeed: [Atomic macOS (AMOS) Stealer Activity](<https://devfeed.tech/articles/atomic-macos-amos-stealer-activity-30906.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/>)

Author: Bradley Duncan

Published: 2026-09-16T10:00:06Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [sensitive data](<https://devfeed.tech/topics/sensitive-data.md>), [Zsh](<https://devfeed.tech/topics/zsh.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [cURL](<https://devfeed.tech/topics/curl.md>)

Tags: [ads](<https://devfeed.tech/tags/ads.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [curl](<https://devfeed.tech/tags/curl.md>), [general](<https://devfeed.tech/tags/general.md>), [insights](<https://devfeed.tech/tags/insights.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sensitive-data](<https://devfeed.tech/tags/sensitive-data.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [unit-42](<https://devfeed.tech/tags/unit-42.md>), [zsh](<https://devfeed.tech/tags/zsh.md>)

### AI overview

This article analyzes a laboratory-generated Atomic macOS (AMOS) stealer infection observed on Aug. 5, 2026. It describes a deceptive macOS toolkit installation page that led users to paste a command into Terminal, retrieving a Zsh script containing an encoded compressed payload and a follow-up script designed to run a Mach-O binary. AMOS targets macOS and can exfiltrate system information, login credentials, and sensitive data from applications including browsers and cryptocurrency wallets.

### Source excerpt

Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.

## The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications

DevFeed: [The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications](<https://devfeed.tech/articles/the-permanent-threat-analyzing-aeternum-s-blockchain-based-c2-operations-and-communications-7739.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/aeternum-blockchain-c2-analysis/>)

Author: Chris Navarrete, Sai Sathvik Ruppa and Haozhe Zhang

Published: 2026-08-10T22:00:02Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [C++](<https://devfeed.tech/topics/c-plus-plus.md>), [Firewall](<https://devfeed.tech/topics/firewall.md>)

Tags: [aeternum](<https://devfeed.tech/tags/aeternum.md>), [analysis](<https://devfeed.tech/tags/analysis.md>), [blockchain](<https://devfeed.tech/tags/blockchain.md>), [c-plus-plus](<https://devfeed.tech/tags/c-plus-plus.md>), [c2](<https://devfeed.tech/tags/c2.md>), [infection-chain](<https://devfeed.tech/tags/infection-chain.md>), [json](<https://devfeed.tech/tags/json.md>), [malware](<https://devfeed.tech/tags/malware.md>), [python](<https://devfeed.tech/tags/python.md>), [rpc](<https://devfeed.tech/tags/rpc.md>), [telegram](<https://devfeed.tech/tags/telegram.md>), [threat-research](<https://devfeed.tech/tags/threat-research.md>), [xmrig](<https://devfeed.tech/tags/xmrig.md>), [xor](<https://devfeed.tech/tags/xor.md>)

### AI overview

An analysis of the Aeternum botnet loader, which uses Polygon blockchain smart contracts and public RPC endpoints for decentralized command-and-control. It also examines related Python malware using the Telegram API and a blended threat involving XWorm RAT, XMRig, and data exfiltration.

### Source excerpt

Analysis of the Aeternum botnet loader, a threat leveraging Polygon blockchain smart contracts for decentralized C2 infrastructure and payload execution. The post The Permanent Threat: Analyzing Aeternum's Blockchain-Based C2 Operations and Communications appeared first on Unit 42.