sha256
ecd1113fae1ede9869afd9d1af612bab7f1a2054e5c45a346e18c107c22b9164
discovered 2026-07-22
payload.enc, the AES-256-CBC encrypted 707-line AMOS-family AppleScript stealer. Decrypts with the upload token 5c6f24c905ae3883355a26fceac3dda0d0dfe67ba8e1220ebe784a29544c6ee4 (SHA-256 key derivation); that same value doubles as the X-Upload-Token in every exfil request.
