Loading malware…
NovaStealer is a macOS-focused information stealer associated with the Atomic macOS Stealer (AMOS) family. It has been distributed through ClickFix-style social engineering and malicious OpenClaw/ClawHub skills masquerading as developer, cryptocurrency, or automation utilities. Victims are induced to execute encoded shell commands that retrieve the stealer. NovaStealer searches for cryptocurrency-wallet data, including data associated with numerous wallet applications, and collects browser cookies, saved login data, SSH keys, cloud credentials, environment files, and host telemetry. Reported variants can replace legitimate Ledger and Trezor applications with tampered copies, enabling theft of cryptocurrency-related data and potential transaction manipulation. The malware has been observed using a dropper and a user-level launch mechanism for persistence, with remotely supplied encoded scripts executed through detached sessions. Its targeting is concentrated on macOS users, particularly cryptocurrency holders and developers.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 CVE Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
The campaign coincides with the disclosure of a high-severity OpenClaw vulnerability (CVE-2026-25253) that enables one-click remote code execution through token exfiltration and WebSocket hijacking. Although patched in late January 2026, the flaw points to the platform’s growing attack surface.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
That command fetched NovaStealer v2, a macOS-focused information stealer linked to the Atomic macOS Stealer family.
7 distinct techniques documented for this family, organized by ATT&CK tactic.
"distribution of MacOS stealers builds via curl payloads, in a ‘Clickfix’ style" and "creating utilities inside the panel to generate curl payloads."
3 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
6 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An information stealer reportedly delivered through malicious OpenClaw ClawHub skills in the ClawHavoc supply-chain campaign.
A macOS-focused information stealer delivered via malicious OpenClaw marketplace packages and ClickFix-style social engineering. It steals data from more than 60 cryptocurrency wallets and also collects browser cookies, login information, SSH keys, cloud credentials, and .env files.
A named macOS stealer family appearing at low prevalence in the reporting period.
Information-stealing malware delivered via malicious OpenClaw “skills,” used to harvest sensitive data (e.g., API keys, credentials, cloud secrets) from infected systems.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.