Moonlock Lab first wrote about Crazy Evil in August 2024, when the group was pushing an AMOS-style stealer behind fake Loom downloads. Two years later they are still in the same business – collaboration-app lures, crypto-adjacent victims – but the tooling has been rebuilt.

In 2026, the Crazy Evil traffer team is still active, and their macOS tooling has moved to a newer family, internally marked SONOMAC1 and informally called Sonoma. It is a compiled Swift infostealer with its own loader family designed to harvest passwords, browser data, developer secrets, and cryptocurrency wallets while staying quieter against antivirus and EDR sensors.

This piece walks through who is behind it, how the malware works, why PAM password checks matter, and why a label of “PamStealer / Avenger” does not apply to this family.

Who is Crazy Evil

Crazy Evil is a traffer-style cybercrime operation that specializes in high-conversion social engineering against cryptocurrency, Web3, and collaboration-software users. Public reporting has long associated the group with sub-teams (including names such as DEFI, ZOOMLAND, AVLAND, and KEVLAND) that push lookalike installers for meeting apps, document viewers, and crypto-adjacent tools.

In August 2024, Moonlock Lab tracked a campaign that used Google-sponsored ads and fake Loom download pages to deliver macOS stealer malware. Darknet recruitment posts from Crazy Evil, including pitches around Ledger replacement on macOS, supported attribution to that group. That earlier activity sat in the AMOS (Atomic macOS Stealer) ecosystem of the time.

Sonoma is the next chapter of that story – not a recycled AMOS build pasted into a new DMG, but a custom builder-and-payload pipeline.

The persona behind much of the macOS tooling appears as ev1lc0rp. Build artifacts recovered from the One Crystal Flip launcher even leaked internal paths such as /var/www/evilcorp/backend/templates/macos/launcher.c, which is consistent with a centralized Malware-as-a-Service-style panel that stamps campaign names, icons, and C2 tokens into fresh Mach-O droppers.

What Sonoma Stealer is

At a high level, Sonoma is a multi-stage macOS infection chain:

• Lure: a DMG or ZIP posing as StreamYard, Zoom, Slack, DocSend, Brave Talk, Riverside-style meeting tools, or other collaboration / Web3 brands.
• Launcher: a universal Mach-O stub (Apple Silicon + Intel) that strips quarantine attributes, decrypts embedded config, and fetches later stages.
• LotC / KEM staging: secondary payloads pulled from attacker domains or from Apple iCloud CalDAV attachment URLs.
• Core stealer: a hidden Swift binary that phishes the login password in-process, dumps Keychain and browser data, scoops wallets and developer secrets, then exfiltrates over HTTPS.

Generation 2 launchers embed the markers SONOMAC1 and sonomab in the Mach-O __const section, spliced into strings that look like /usr/bin/zsh and com.apple.quarantine. That operator tag is where the name “Sonoma Stealer” comes from – not Apple’s macOS Sonoma release.

How victims are pulled in

Crazy Evil continues to favor conversion over exotic exploits. Someone searching for StreamYard or Slack, or accepting a “join our podcast” calendar invite, downloads a .dmg or .zip. The volume looks like an installer. The binary inside is ad-hoc signed – no Developer ID, no notarization, no Team ID.

On first run the launcher strips Gatekeeper’s quarantine flag (xattr -dr com.apple.quarantine, and in Gen 2 also xattr -cr), then runs a second stage. Older builds dropped /tmp/.appbootstrap.XXXXXX, executed it with /bin/zsh, and unlink()’d it. Newer builds prefer /bin/zsh -s and a pipe, so less lands on disk.

Table 1. Sandbox process tree for the StreamYard Gen-2 launcher. Quarantine strip (xattr -dr / xattr -cr), piped zsh -s, then the pkgunpack KEM path into dm5ne99sw9.

A later window asks for the Mac login password, dressed as a system dialog. If the password is wrong, the dialog shakes and asks again. That loop is the point: the operators want a working password, not a typo.

Legitimate StreamYard and similar products run in the browser. They do not ship an unsigned “installer.app” that immediately asks for your login password.

The fake installer is not only StreamYard. The same chain has shipped as meeting, document, wallet-adjacent, and regional-browser brands. Brands we have seen so far:

• Meeting / recording: StreamYard, Zoom, Brave Talk, Toria, Waaako, Meendo
• Docs / collab: DocSend, Slack
• Payments / Web3-adjacent: CavePay, Crystal Flip
• Browser: Cốc Cốc (CocCoc) – Vietnamese Chromium browser.

Moonlock telemetry already shows Sonoma activity on customer Macs. In the snapshot below, detections concentrate in Spain and Japan – useful as a reminder that this is live traffic, not a lab-only sample set.

Note: Moonlock telemetry for this snapshot comes only from Macs running Moonlock or CleanMyMac, so the map is a view into our install base, not a full picture of worldwide infections. Blank countries do not mean Sonoma is absent there. We still read this as an active, growing campaign, and we will post follow-up telemetry and findings on X/Twitter and in our Discord.

Inside the core stealer

The sample we analyzed is a universal FAT Mach-O compiled as Swift with Cocoa/AppKit UI and links to libpam.2.dylib, libsqlite3.dylib, and Security.framework. It runs as a background-style app (LSUIElement set so it stays off the Dock).

Password phishing with PAM (not dscl)

Older commodity macOS stealers, including much of the AMOS ecosystem, often validate a phished password by shelling out to tools like dscl, or by driving an AppleScript display dialog. Those patterns are noisy for EDR: they create child processes and distinctive command lines.

Sonoma’s core takes a quieter path:

• It presents a custom AppKit modal (internal naming such as MacClient.SystemInputShell / AuthPromptWindow) styled to resemble a macOS security prompt, for example, claiming privileges are needed to configure audio and video.
• The typed password is checked in-process through macOS Pluggable Authentication Modules via /usr/lib/libpam.2.dylib (pam_authenticate / related verify helpers).
• Invalid passwords shake the dialog and re-prompt; a valid password is then used to unlock the login Keychain (for example via security unlock-keychain) so Security framework APIs such as SecItemCopyMatching can export stored items.

That PAM shift is a deliberate anti-detection improvement: fewer suspicious shell children, same practical outcome for the attacker.

Lock-free browser database cloning

Browser cookie and login databases are SQLite files that are often locked while Chrome, Brave, Arc, Edge, Opera, Firefox, Safari, and similar apps are running. Blind cp fails with SQLITE_BUSY.

Sonoma links libsqlite3.dylib and uses SQLite’s online backup APIs (sqlite3_backup_init / sqlite3_backup_step) to clone Cookies, Login Data, Web Data, and related stores into memory-friendly replicas. Combined with broad Chromium and Gecko coverage, that is a meaningful reliability upgrade over “copy the file and hope.”

What else it collects

Across samples and staging notes, the stealer’s shopping list is familiar but thorough:

• Cryptocurrency: browser extension storage for MetaMask, Phantom, Coinbase Wallet, Binance Chain, OKX, Trust Wallet, Rabby, Ronin, and others; desktop wallet material from Ledger Live, Trezor Suite, Exodus, Electrum, Wasabi, Coinomi, Bitcoin Core, and related paths.
• Developer and cloud secrets: ~/.aws/, ~/.kube/, Azure configs, SSH keys under ~/.ssh/, shell history, and git config.
• Host profiling: hardware UUID (IOPlatformUUID), uptime via kern.boottime, and system_profiler snapshots – useful both for victim inventory and for skipping short-lived sandbox VMs.

Harvested data is packaged and uploaded over HTTPS to attacker’s servers such as 109[.]94.171.225:443 (Greencloud LLC), often with retry/backoff and cleanup of /tmp staging files after success.

Living-off-the-cloud: iCloud CalDAV as a delivery CDN

One of Sonoma’s more interesting evasion tricks is abusing Apple iCloud Calendar (CalDAV) as a payload host.

In the Toria.dmg chain, after quarantine stripping, the launcher curls a Loader.app.tar.gz from gateway.icloud.com/caldav/..., extracts it under /tmp/.ldr-*, strips attributes, ad-hoc signs the app, and launches it. Later stages add anti-debug (ptrace(PT_DENY_ATTACH)), AES decryption, and piping into /bin/zsh -s.

Enterprise filters routinely trust *.icloud.com, and the TLS certificate is Apple’s – blocking it breaks real calendar sync. Disposable iCloud accounts thus become a resilient staging CDN.

StreamYard-style launchers also use a pkgunpack helper for a Curve25519 ephemeral exchange against /v1/loader/dek, then AES-GCM-unwrap the core archive, so encrypted blobs captured offline without the live handshake are much harder to decrypt.

Detection note

A practical hunt: legitimate Calendar sync does not look like /usr/bin/curl downloading a .tar.gz from gateway.icloud.com/caldav/ into tar. Chains that pair xattr -cr on /tmp with immediate codesign -fs - --deep also deserve review.

Not PamStealer

On 14 September 2026, researcher @L0Psec published a thread on Toria.dmg and the follow-on payload. The final stage talks to PAM, so the working hypothesis was PamStealer (sometimes discussed as Avenger).

That label is understandable at a glance (both families validate passwords through PAM), but let’s take a closer look at them.

Jamf Threat Labs documented PamStealer (Avenger) in July 2026. That family is a compiled AppleScript / JXA dropper plus a Rust second stage. It validates the login password with pam_start / pam_authenticate / pam_end, impersonates the clipboard app Maccy, and beacons to avenger-sync[.]live.

Sonoma is a different codebase. PAM on macOS is not a family name. It is an API. Two stealers can call it without being related.

PamStealer versus Sonoma

From EV1LC0RP to SONOMAC1

Before SONOMAC1, Crazy Evil’s macOS developer persona was already visible in an earlier loader generation marked EVLCFG01, with the rolling XOR key ev1lc0rp. In the material we compared, that first loader family and the Sonoma (SONOMAC1) builds sit only about a month apart. It’s a short window for a fairly large engineering jump.

Generation 1 showed up as DocSend-style installers (for example DocSendInstaller.zip / MNOBS.zip). The Mach-O launcher carried an EVLCFG01 overlay, decrypted trailer config with the ev1lc0rp key, dropped shell stagers under /tmp/.appbootstrap.*, and leaned on companion scripts such as installer.sh with OpenSSL AES-CBC for payload unwrap. The core name observed in that generation was aa9hb9425l.

Staging still wrote a harvest archive to disk as /tmp/osalogging.zip before uploading it to the attackers server. That zip path is worth a separate note. /tmp/osalogging.zip has long been a practical hunting indicator for MacSync (sometimes discussed as Mac.c) – another commercial macOS stealer family. Seeing the same artifact in Crazy Evil’s EVLCFG01 staging does not prove they forked MacSync wholesale, but it does fit a familiar pattern: traffer teams assembling a new product by borrowing working pieces from more than one existing solution. AMOS-era habits, MacSync-style packaging names, and later a custom Swift core with PAM and CalDAV LotC all show up in the same Crazy Evil timeline.

Generation 1 vs Generation 2 loaders

Table. Architectural comparison of Crazy Evil’s Generation 1 (EVLCFG01 / ev1lc0rp) loaders versus Generation 2 (SONOMAC1 / sonomab).

Advice for macOS users

• Don’t install meeting software from cold DMs or lookalike domains. Prefer the browser when that is how the real product works.
• Treat unexpected password prompts during “setup” as hostile until proven otherwise — real installers rarely loop until your login password validates.
• Be wary of calendar invites that push urgent downloads; Apple-signed mail can still carry attacker content.
• Keep Gatekeeper intact. Stop if something asks you to clear quarantine flags or run unsigned helpers from /tmp.
• Run Moonlock App for layered Mac protection once social engineering has already dropped a file – it is built around the same macOS threat research we publish here.
• Crypto users: hardware wallets help, but seeds, browser extensions, and cloned wallet apps remain prime targets.

Closing

Crazy Evil did not disappear after the 2024 campaign. They kept shipping: better launchers, Swift-native harvesting, PAM instead of noisy dscl checks, KEM staging, and CalDAV LotC delivery.

Sonoma is a reminder that macOS actors often win with trust abuse - fake meetings, familiar brands, and almost-official password prompts — more than with zero-days. Separating Sonoma (Swift, Crazy Evil) from PamStealer (Rust, per Jamf) keeps attribution and hunting aimed at the right infrastructure.

Moonlock Lab will keep tracking this cluster as builds rotate. If you want practical coverage on the Mac itself, Moonlock App is the product side of that work.

This publication is independent and is not authorized, sponsored, or approved by Apple Inc. Mac and macOS are trademarks of Apple Inc.

Indicators of compromise

Hashes and hosts below are drawn from Moonlock Lab’s Sonoma / Crazy Evil Generation-1–2 material (including Toria CalDAV staging and apple03cloudstore[.]com campaigns). Treat them as starting points – operators rotate lure brands, builds, and tokens frequently.

File hashes (SHA-256)

Network indicators

URL / HTTP path patterns (hunting): /v1/loader/dek (KEM DEK exchange; header X-Upload-Token), /pkgunpack, /CoreUpdate.pkg.enc, /agent.zsh, exfil-style /v1/upload or /exfil on Greencloud receivers.

Host / filesystem artifacts

Behavioral / command-line hunt ideas

Concise signals only, no reproduction playbook:

• curl (or shell) to gateway.icloud.com/caldav/ piping into tar under /tmp/.ldr-* (legitimate Calendar sync does not look like this).
• xattr -cr / xattr -dr com.apple.quarantine on /Volumes/… or /tmp/… immediately followed by codesign -fs - --deep and open -gn.
• curl \| zsh (or /bin/zsh -s) fetching /agent.zsh from *.apple03cloudstore[.]com, or piping decrypted content into zsh after /tmp/.sys-*.
• POST to /v1/loader/dek with X-Upload-Token and JSON body fields eph_pub_b64 / nonce.
• Helper invocations resembling /tmp/.pkgunpack-* genkey / decrypt and unpack into /tmp/.upd-*.
• User-Agent string observed on stagers: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36.