Loading malware…
Atomic Stealer, also known as AMOS, is a macOS-focused information-stealing malware offered through a malware-as-a-service model and associated with Russian-speaking cybercriminal activity. It is one of the most prominent stealer families targeting Apple systems and is frequently discussed alongside other macOS stealers such as Poseidon, Odyssey, MacSync, and Banshee.
The malware is designed to harvest a broad range of sensitive data from compromised macOS hosts. Reported objectives include theft of browser-stored credentials, session cookies, cryptocurrency wallet data, and other user information commonly monetized through account takeover, fraud, and follow-on intrusion activity. Atomic has been cited as part of the broader infostealer ecosystem used to bypass multi-factor authentication through stolen web session material.
Observed distribution methods include fake websites impersonating trusted macOS developer tools, malicious GitHub repositories posing as legitimate software installers, ClickFix-style social-engineering lures, malicious advertising, and free or cracked software. Atomic has also been delivered in campaigns abusing the popularity of AI tooling and software ecosystems, including fake installer repositories and deceptive verification or troubleshooting flows that induce users to execute attacker-supplied commands.
Atomic targets macOS users, including enterprise and high-value individuals, and has appeared in campaigns aimed at cryptocurrency theft as well as general credential and session theft. Its prevalence reflects the growing commercial market for macOS infostealers and the increasing focus by threat actors on Apple platforms.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...distribute... information stealers, such as Atomic (AMOS), Lumma, Rhadamanthys... and Vidar..."
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Some adversaries have used lures designed specifically for macOS users that encourage the user to open Spotlight, then macOS Terminal to execute malicious commands.
In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”
The adversary is trying to entice the user into verifying or fixing something by typing a command into a terminal, run dialog box, or PowerShell.
The viral popularity of OpenClaw has also led threat actors to capitalize on the phenomenon to distribute malicious GitHub repositories posing as OpenClaw installers to deploy information stealers like Atomic and Vidar Stealer, and a Golang-based proxy malware known as GhostSocks using ClickFix-style instructions.
These stealer malware families – of which there are many, such as Atomic, Lumma, and Vidar Stealer – come with capabilities to harvest a wide range of information from compromised systems, including cookies. | Session theft involves the covert exfiltration of session cookies from the web browser, either by gathering existing ones or waiting for a victim to log in to an account, to an attacker-controlled server.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
16 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Atomic3
Referenced as another macOS stealer family used for comparison with CrashStealer.
Referenced as another macOS stealer family with overlapping objectives to CrashStealer.
Referenced only as another infostealer family for comparison with CrashStealer.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.