Atomic Stealer (AMOS): The Infostealer That Made macOS a Target

Atomic Stealer, known as AMOS, is a macOS infostealer sold as malware-as-a-service, first advertised on Telegram in April 2023 and now widely described as the dominant macOS stealer family. macOS matters here because a single run can harvest the Apple Keychain, browser data and cryptocurrency wallets from a platform long assumed safer, and stolen credentials and session cookies feed downstream fraud and intrusions. Sophos reported (vendor telemetry, not a population figure) that stealers accounted for more than half of its macOS detections over a recent window, with AMOS among the most common.

Capabilities

• A Go-based 64-bit Mach-O, typically delivered in a DMG; it shows a fake macOS password prompt (via osascript) to capture the system password, then dumps the login Keychain. T1056 T1555.001
• Steals browser credentials, cookies and autofill/payment data, plus desktop crypto wallets and dozens of wallet browser extensions, with MetaMask seed/key targeting offered through the MaaS panel. T1555.003
• Collects system information and files, then ZIPs and exfiltrates to C2. T1082 T1083 T1041
• A backdoored build reported in 2025 (Moonlock) added arbitrary command execution and reboot persistence — a shift from smash-and-grab to persistent access (vendor assessment, hedged).

Delivery

• Google malvertising and SEO poisoning impersonating popular software (for example a 2023 fake TradingView campaign). T1566.002
• Fake or “cracked” app installers in DMGs, with instructions to right-click-open or paste Terminal commands to bypass Gatekeeper.
• ClickFix-style fake fixes: a June 2025 campaign served a shell script via typosquatted pages, and a 2026 Jamf-reported variant uses a no-Terminal flow that auto-copies script into Script Editor.
• Fake GitHub repositories and pages impersonating 100+ brands, SEO-optimised to rank.

Detection & Mitigation

• Alert on osascript spawning password dialogs and on processes reading login.keychain-db or browser credential stores outside expected apps.
• Block execution of unsigned or ad-hoc-signed apps from DMGs, enforce Gatekeeper, and do not let users bypass it; train users against paste-to-Terminal and ClickFix “fix” prompts.
• Monitor curl/bash fetch-and-run chains and outbound ZIP exfiltration to newly registered domains; deploy macOS EDR and keep XProtect/macOS current.
• Use hardware wallets and avoid storing seed phrases on disk; rotate credentials and revoke sessions after any infection, and prefer phishing-resistant MFA.