Last seven days
- First activity
- Jul 14, 2026
- Last activity
- Jul 14, 2026
- Feed role
- C2
- Host form
- 2 IP / 0 hostnames
Malware family macOS
Atomic Stealer
Atomic macOS Stealer, commonly abbreviated AMOS, is a macOS-focused infostealer used to steal credentials, browser data, cryptocurrency wallet material, and other sensitive user information.
Profile source: Mallory opens in a new tabAtomic Stealer
Family profile
Atomic macOS Stealer, commonly abbreviated AMOS, is a macOS-focused infostealer used to steal credentials, browser data, cryptocurrency wallet material, and other sensitive user information. It has been active in multiple criminal campaigns and is frequently associated with social-engineering-driven delivery, especially ClickFix-style lures that trick victims into pasting attacker-supplied commands into Terminal. AMOS has also appeared in poisoned AI chatbot conversations, malicious sponsored ads, typosquatted marketplace content, and fake utility or troubleshooting workflows targeting Mac users.
AMOS targets macOS systems, including both Intel and Apple Silicon environments through universal Mach-O payloads in some observed variants. Its collection scope commonly includes saved browser credentials, cookies, form data, session material, Apple Keychain data, Telegram session data, iCloud-related information, notes, shell history, and files from desktop and browser-based cryptocurrency wallets. Reported wallet targeting includes both software wallets and companion applications for hardware wallets. Some campaigns have also used trojanized wallet application replacements to increase theft opportunities.
Observed AMOS tradecraft includes extensive use of native macOS utilities and AppleScript, local password validation, archive creation, and HTTP-based exfiltration. Variants have been seen prompting victims with fake macOS authentication dialogs to capture the login password, querying Keychain items, collecting host profiling data, and compressing stolen material before transmission. Some AMOS-linked activity has used in-memory loaders, obfuscated shell stages, and fragmented payload reconstruction to reduce visibility. Persistence has also been documented in certain variants through LaunchAgents and fake updater components that can execute follow-on commands, extending the malware beyond pure one-time theft.
AMOS is heavily represented in campaigns aimed at cryptocurrency users, developers, and Web3 communities, but its theft scope is broader than crypto alone. It has been delivered through compromised websites, phishing-style landing pages, malicious ads, and abusive AI-agent marketplace content. Related reporting also places AMOS alongside other macOS stealers such as MacSync and SHub Stealer in broader waves of macOS ClickFix activity. The malware reflects the maturation of the macOS criminal malware ecosystem and the growing attacker focus on enterprise and consumer Mac endpoints as viable targets for credential theft, session hijacking, and financial theft.
Capabilities
- Credential Theft
- Crypto Theft
- Defense Evasion
- Exfiltration
- Persistence
- Reconnaissance
- Session Hijacking
C2 tracking
Seven-day C2 activity
Derp observations, rolling seven-day window
2 Jul 14
Observed infrastructure
Leading locations
- FI1
- NL1
Leading providers
- AEZA GROUP LLC1
- DigitalOcean, LLC1
Infrastructure traits
- Hosting 2
Reported operators
Threat actors
6 named in public reportingA separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file, then padded it with 22 MB of junk characters to exceed file size limits that most scanning pipelines enforce.
The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents.
Diversified Malware Toolkit: Crazy Evil uses advanced tools like Stealc and AMOS for Windows and macOS, ensuring widespread compromise.
Odyssey isn’t original work. It’s a direct rebrand of Poseidon Stealer, which itself was forked from Atomic macOS Stealer (AMOS).
Odyssey isn’t original work. It’s a direct rebrand of Poseidon Stealer, which itself was forked from Atomic macOS Stealer (AMOS).
Two new AMOS (Atomic macOS Stealer) samples uploaded to MalwareBazaar reveal a significant evolution of the macOS stealer family.
Exploited software
Vulnerabilities linked to Atomic Stealer
2 CVEsMITRE ATT&CK
Atomic Stealer in ATT&CK
83 distinct techniquesTechniques
83 techniques T1204 User Execution T1033 System Owner/User Discovery T1083 File and Directory Discovery T1027 Obfuscated Files or Information T1555 Credentials from Password Stores T1082 System Information Discovery T1539 Steal Web Session Cookie T1560 Archive Collected Data T1059.002 AppleScript T1059.004 Unix Shell T1041 Exfiltration Over C2 Channel T1555.003 Credentials from Web Browsers T1036 Masquerading T1566 Phishing T1070.004 File Deletion T1543.001 Launch Agent T1140 Deobfuscate/Decode Files or Information T1497 Virtualization/Sandbox Evasion T1056 Input Capture T1070 Indicator Removal T1566.002 Spearphishing Link T1053 Scheduled Task/Job T1071 Application Layer Protocol T1622 Debugger Evasion T1105 Ingress Tool Transfer T1567 Exfiltration Over Web Service T1620 Reflective Code Loading T1059 Command and Scripting Interpreter T1005 Data from Local System T1564.003 Hidden Window T1195 Supply Chain Compromise T1204.002 Malicious File T1027.001 Binary Padding T1564.001 Hidden Files and Directories T1553.001 Gatekeeper Bypass T1649 Steal or Forge Authentication Certificates T1598 Phishing for Information T1583.001 Domains T1497.001 System Checks T1583 Acquire Infrastructure T1132.001 Standard Encoding T1110 Brute Force T1555.001 Keychain T1189 Drive-by Compromise T1528 Steal Application Access Token T1656 Impersonation T1204.003 Malicious Image T1574.001 DLL T1078 Valid Accounts T1056.002 GUI Input Capture T1562.001 Disable or Modify Tools T1543.004 Launch Daemon T1552 Unsecured Credentials T1071.001 Web Protocols T1106 Native API T1548.002 Bypass User Account Control T1204.004 Malicious Copy and Paste T1008 Fallback Channels T1074 Data Staged T1219 Remote Access Tools T1195.002 Compromise Software Supply Chain T1036.005 Match Legitimate Resource Name or Location T1056.003 Web Portal Capture T1566.003 Spearphishing via Service T1584.001 Domains T1560.002 Archive via Library T1104 Multi-Stage Channels T1204.001 Malicious Link T1059.007 JavaScript T1608.006 SEO Poisoning T1570 Lateral Tool Transfer T1218 System Binary Proxy Execution T1222 File and Directory Permissions Modification T1222.002 Linux and Mac File and Directory Permissions Modification T1203 Exploitation for Client Execution T1586 Compromise Accounts T1584 Compromise Infrastructure T1048.003 Exfiltration Over Unencrypted Non-C2 Protocol T1614 System Location Discovery T1210 Exploitation of Remote Services T1583.008 Malvertising T1583.002 DNS Server T1566.001 Spearphishing Attachment
Reporting
Research mentioning Atomic Stealer
Jul 17
Rhisac
RH-ISAC | Current ClickFix Threat Landscape Developments - RH-ISAC
While ClickFix has historically targeted Windows users, researchers recently observed its delivery of Atomic Stealer malware on macOS systems, leading experts to warn that “macOS must no longer be treated as lower risk.”
Jul 17
Cyber Security News
New ClickLock macOS Stealer Kills Every App to Force Password Entry
This shift mirrors recent trends where Mac endpoints are targeted directly via the web, such as the Atomic Stealer ClickFix attack.
Jul 16
The Hacker News
New ClickLock macOS Stealer Kills Apps Every 210ms Until Victims Type Their Password
Microsoft documented the same dscl validation in SHub Stealer in May, alongside AMOS and MacSync in the same wave of macOS ClickFix campaigns.
Jul 16
Group Ib
ClickLock Stealer: Paste Once, Lose Everything | Group-IB Blog
Although the macOS threat landscape has grown considerably in recent years, with malware like Atomic Stealer (AMOS), Banshee Stealer, Poseidon, Cuckoo, Cthulhu Stealer and MacStealer...
Jul 15
Cryptika
Hackers Abuse Shared Claude Chats and Google Ads to Deploy MacSync Stealer on macOS | Cryptika Cybersecurity
Hackers Used EvilTokens, ClickFix Campaign to Attack Claude Code Users with AMOS Stealer
Jul 15
The Hacker News
OkoBot Malware Framework Injects Seed Phrase Phishing Into Ledger and Trezor Apps
AMOS killed Ledger Live and dropped a trojanized clone in /Applications demanding the 24 words.
Jul 15
Zdnet Zero Day
New Mac malware masquerades as Apple's crash reporter: 3 ways to dodge the threat | ZDNET
As described by Huntress researchers, Atomic MacOS Stealer is being distributed through poisoned AI chatbot conversations that lead unwitting victims to malicious websites and payloads.
Jul 13
Medium Slowmist
Analysis of a Google Sites Community Application Phishing Campaign and macOS Information-Stealing Malware | by SlowMist | Jul, 2026 | Medium
Static reverse engineering indicates that the sample is a macOS information stealer whose behavioral characteristics are highly consistent with variants of AMOS (Atomic macOS Stealer).
