Loading malware…
AMOS Stealer, also known as Atomic macOS Stealer or Atomic Stealer, is a macOS information-stealing malware family sold as malware-as-a-service through Telegram and underground forums. It is used in financially motivated campaigns to collect credentials, browser session cookies, saved logins, autofill data, cryptocurrency-wallet data, Telegram Desktop sessions, macOS Keychain databases, selected user documents, and system information. Its targets include Chromium-based browsers and Firefox. Observed samples support both Intel and Apple silicon Macs.
AMOS commonly executes theft routines through AppleScript and uses native macOS utilities to download payloads, collect and compress data, and exfiltrate archives to attacker-controlled infrastructure. It can display fake system dialogs to obtain the user's account password. Analyzed variants encrypt or encode their AppleScript payloads, check for virtualized environments, hide Terminal activity, and remove temporary collection artifacts after exfiltration. Login Items persistence has also been observed.
Distribution relies heavily on social engineering, including malicious advertisements, deceptive software installers, cracked applications, fake toolkit websites, and ClickFix instructions that persuade users to paste commands into Terminal. Campaigns have impersonated Claude Code installation guides, abused publicly shared ChatGPT and Grok conversations, modified download links in forked GitHub repositories, and delivered AMOS through malicious OpenClaw skills distributed on ClawHub. The ClearFake distribution framework has also delivered AMOS to macOS users.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
We found connections between ShadowSyndicate infrastructure and Amos Stealer infrastructure (moderate confidence)
29 distinct techniques documented for this family, organized by ATT&CK tactic.
ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.
An active malware distribution campaign abusing two prominent AI platforms Hugging Face and ClawHub to deliver trojans, cryptominers, and infostealers disguised as legitimate AI tools and agent extensions. The campaign marks a significant evolution in supply chain attacks, shifting from traditional software repositories to trusted AI ecosystems.
Shown above: Text from the fake Brew page pasted into a terminal Window.
The AMOS Stealer is a macOS malware known for its data theft capabilities, often delivered via an encrypted osascript (AppleScript) payload.
Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.
The sidebar provided two follow-on options: ClickFix-style instructions and a download option, both intended to download and execute malicious code.
This involved a Google Doc featuring a custom Google Apps Script sidebar designed to guide them through the execution of malware.
AMOS has been distributed through ClickFix campaigns, malicious advertisements, and websites offering cracked versions of popular software. These sites use fake installation instructions, such as a supposed macOS toolkit, to trick users into installing the malware.
MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.
MacOS maintains a list of applications that should be automatically opened when a user logs in. This list is stored in the com.apple.loginwindow preferences domain under the key AutoLaunchedApplicationDictionary ... it is the programmatic equivalent of a user manually adding an app to their “Login Items” in System Settings.
For Windows targets, payloads were detected as trojans packed with VMProtect... A second Windows payload used a 30-byte XOR key to decrypt strings at runtime... The FAKESECURITY campaign used a batch script (CDC1.bat) containing an encoded PowerShell blob...
This analysis examines an AMOS Stealer infection ... delivered through a page promoting a fake “macOS toolkit.”
After a successful upload, Amos Stealer runs the cleanup commands ( rm -f /tmp/osalogging.zip and rm -rf /tmp/sync ) to erase its presence.
AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.
Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.
It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.
It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.
It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.
Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.
68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS information stealer delivered through a malicious advertisement and website impersonating Claude Code. The documented infection uses ClickFix-style instructions to persuade the victim to paste a script into macOS Terminal. The malware subsequently displays password and permission requests.
A macOS stealer mentioned only for comparison. The author has not identified the malware delivered by the MacFinger ClickFix campaign and states that it does not appear to be AMOS Stealer. MacFinger is presented as a campaign name, not an identified malware family.
A macOS information stealer that collects system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications. It has been distributed through ClickFix campaigns, malicious advertisements, and fake/cracked-software websites that use fraudulent installation instructions.
A stealer referenced as part of prior AI-hosted ClickFix campaigns, not the main malware in this report.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.