Cookie Spider
COOKIE SPIDER is a cybercriminal threat actor tracked by CrowdStrike and described as a malware-as-a-service (MaaS) provider. The group is identified in the content as the developer and renter of Atomic macOS Stealer (AMOS), including the SHAMOS variant. CrowdStrike attributed SHAMOS development to COOKIE SPIDER and reported the group used malvertising and fake macOS help/support sites to trick users into executing one-line Terminal commands that downloaded and installed the stealer, including techniques intended to bypass Gatekeeper. The campaign targeted more than 300 customer environments between June and August 2025 and used lures related to macOS troubleshooting and fake software repositories, including malicious GitHub-hosted install instructions. The content states that COOKIE SPIDER’s macOS malware used anti-VM checks, AppleScript-based reconnaissance and collection, theft of credentials and browser data, and targeting of cryptocurrency wallets and related files. Reported collection included Keychain, Apple Notes, browser data, and wallet artifacts, with exfiltration via curl as ZIP archives. Additional reporting in the content describes newer AMOS samples linked through overlapping infrastructure with earlier AMOS/OpenClaw activity attributed to COOKIE SPIDER. Those samples expanded targeting toward cryptocurrency theft, including browser wallet extensions, desktop wallet applications, replacement of legitimate Ledger, Trezor, and Exodus apps with trojanized clones that phish 24-word BIP39 seed phrases, and installation of a persistent backdoor named kito. The malware was reported to use multilayer encryption, pipe-based execution to hide decrypted payloads, persistence via com.finder.helper.plist and /.agent, and separate infrastructure for stealer exfiltration, backdoor tasking, and seed-phrase collection. The content also states that malicious OpenClaw/ClawHub skills and social-engineering comments were used to deliver Atomic Stealer payloads, and explicitly identifies Atomic Stealer as developed and rented by Cookie Spider. No nation-state attribution is stated in the content. Known alias in the provided content: cookie_spider.
Know when an actor pivots toward your sector
Mallory correlates actor tradecraft and target patterns against your stack, your sector, and your geography. See overlap before they land.
Tradecraft
22 distinct techniques observed across reporting, grouped by tactic. Hover any cell for the evidence excerpt; click through for MITRE's full description.
Associated malware families
2 malware families attributed to this actor across reporting.
Observables
47 indicators attributed to this actor: domains, IPs, hashes, and other artifacts pulled from reporting. View more in app.
Recent activity
8 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Operating and rapidly evolving the AMOS macOS stealer campaign, including credential theft, browser and wallet data theft, replacement of legitimate Ledger/Trezor/Exodus apps with trojanized clones to phish BIP39 seed phrases, and deployment of the kito persistence backdoor via a three-tier C2 infrastructure.
Cybercrime actor associated with developing and renting Atomic Stealer, a macOS information stealer delivered via malicious OpenClaw/ClawHub skills.
MaaS operator behind a variant of Atomic macOS Stealer (SHAMOS), delivered via ClickFix-style social engineering to run terminal commands that download and execute the stealer and additional payloads (e.g., spoofed wallet app, botnet module).
COOKIE SPIDER is a cybercriminal group responsible for developing and deploying macOS infostealers (AMOS/SHAMOS) using social engineering and ClickFix techniques to compromise users.
The version that knows your environment.
Match sector + geo + tech-stack targeting against your real footprint.
Every observed MITRE ATT&CK technique, grouped by tactic.
Families this actor is known to deploy, with IOCs and behavior.
CVEs this actor has used in known campaigns.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Domains, IPs, and hashes tied to this actor, refreshed continuously.