Skuggaheimar/Threat Intelligence/Atomic Stealer
ATOMIC STEALER
AMOS
MACOS MALWARE
ECRIME
Threat IntelligenceMalwareJune 26, 2025•15 min read

Atomic Stealer: Threat Intelligence Profile

macOS information stealer

Scroll

Atomic Stealer (macOS) (also known as AMOS, Atomic macOS Stealer) is a macos malware active since 2023. macOS information stealer. Key characteristics include: Keychain passwords, browser data, crypto wallets, file grabber, $1000/month MaaS, malvertising delivery.

Overview & Background

macOS information stealer. First identified in 2023, this threat is attributed to eCrime (MaaS).

Threat Assessment

Atomic Stealer remains an active threat. Organizations should implement detection rules and monitor for indicators associated with this macos malware.

Technical Analysis

Atomic Stealer employs the following capabilities and techniques:

MITRE ATT&CK Mapping

TacticTechniqueUsage
Initial AccessT1566.001 Phishing AttachmentCommon delivery vector
ExecutionT1204.002 Malicious FileUser-triggered execution
PersistenceT1547.001 Registry Run KeysAutostart persistence
Defense EvasionT1027 Obfuscated FilesPayload obfuscation
C2T1071.001 Web ProtocolsHTTP/HTTPS C2

Detection & Defense

Defend Against Atomic Stealer

Mjolnir Security provides detection and response capabilities against Atomic Stealer and similar threats.

Threat DetectionIncident ResponseThreat HuntingMDR ServicesThreat Intelligence
  • Proactive Threat Hunting Hunt for Atomic Stealer indicators and TTPs within your environment.
  • Threat Intelligence Monitor Atomic Stealer campaigns and infrastructure changes.
  • 24/7 Incident Response Rapid containment and forensic investigation. Call +1 833 403 5875.
Written by: Mjolnir Security  |  Published: June 26, 2025
Related Reports
Malware

RedLine Stealer: Cybercrime Empire

Read Report →
Malware

Cobalt Strike: Adversary's Arsenal

Read Report →