Loading malware…
Atomic macOS Stealer, commonly abbreviated AMOS, is a macOS-focused infostealer used to steal credentials, browser data, cryptocurrency wallet material, and other sensitive user information. It has been active in multiple criminal campaigns and is frequently associated with social-engineering-driven delivery, especially ClickFix-style lures that trick victims into pasting attacker-supplied commands into Terminal. AMOS has also appeared in poisoned AI chatbot conversations, malicious sponsored ads, typosquatted marketplace content, and fake utility or troubleshooting workflows targeting Mac users.
AMOS targets macOS systems, including both Intel and Apple Silicon environments through universal Mach-O payloads in some observed variants. Its collection scope commonly includes saved browser credentials, cookies, form data, session material, Apple Keychain data, Telegram session data, iCloud-related information, notes, shell history, and files from desktop and browser-based cryptocurrency wallets. Reported wallet targeting includes both software wallets and companion applications for hardware wallets. Some campaigns have also used trojanized wallet application replacements to increase theft opportunities.
Observed AMOS tradecraft includes extensive use of native macOS utilities and AppleScript, local password validation, archive creation, and HTTP-based exfiltration. Variants have been seen prompting victims with fake macOS authentication dialogs to capture the login password, querying Keychain items, collecting host profiling data, and compressing stolen material before transmission. Some AMOS-linked activity has used in-memory loaders, obfuscated shell stages, and fragmented payload reconstruction to reduce visibility. Persistence has also been documented in certain variants through LaunchAgents and fake updater components that can execute follow-on commands, extending the malware beyond pure one-time theft.
AMOS is heavily represented in campaigns aimed at cryptocurrency users, developers, and Web3 communities, but its theft scope is broader than crypto alone. It has been delivered through compromised websites, phishing-style landing pages, malicious ads, and abusive AI-agent marketplace content. Related reporting also places AMOS alongside other macOS stealers such as MacSync and SHub Stealer in broader waves of macOS ClickFix activity. The malware reflects the maturation of the macOS criminal malware ecosystem and the growing attacker focus on enterprise and consumer Mac endpoints as viable targets for credential theft, session hijacking, and financial theft.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
2 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.
"A critical remote code execution (RCE) vulnerability, identified as CVE-2025-55182 and dubbed React2Shell, exists within the React Server Components (RSC) architecture, allowing unauthenticated attackers to execute arbitrary code..."
The campaign coincides with the disclosure of a high-severity OpenClaw vulnerability (CVE-2026-25253) that enables one-click remote code execution through token exfiltration and WebSocket hijacking. Although patched in late January 2026, the flaw points to the platform’s growing attack surface.
6 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
A separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file, then padded it with 22 MB of junk characters to exceed file size limits that most scanning pipelines enforce.
The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents.
Diversified Malware Toolkit: Crazy Evil uses advanced tools like Stealc and AMOS for Windows and macOS, ensuring widespread compromise.
Odyssey isn’t original work. It’s a direct rebrand of Poseidon Stealer, which itself was forked from Atomic macOS Stealer (AMOS).
Odyssey isn’t original work. It’s a direct rebrand of Poseidon Stealer, which itself was forked from Atomic macOS Stealer (AMOS).
Two new AMOS (Atomic macOS Stealer) samples uploaded to MalwareBazaar reveal a significant evolution of the macOS stealer family.
30 distinct techniques documented for this family, organized by ATT&CK tactic.
The attackers hosted the page on Google Sites, leveraging the trusted appearance of sites.google.com to lower users’ guard. The first part of the page mimicked a community application form... users were redirected to a fake security verification page.
The analyzed campaign represents a mature malware delivery operation in which the central role is played by trusted SaaS and serverless infrastructure. The combination of SEO poisoning, ClickFix and late-stage payload delivery enables effective bypassing of detection mechanisms
the registration of a LaunchAgent executed every 60 seconds. This agent communicates with the C2 server, retrieving Base64-encoded commands that are then executed locally.
The final payload is retrieved and executed in memory (IEX)...
tricking users into downloading a .scpt file or copying and executing a Terminal command.
Sensitive strings within the sample — including file paths, shell commands, and C2 server addresses — are not stored in plaintext. Instead, they are embedded as encrypted blocks in the __const section and decrypted individually at runtime.
The attackers impersonated technical prompts related to api_error_401, OAuth 2.0, and macOS security verification... The attackers use a blue Google-style header, the error name api_error_401, technical terms such as OAuth 2.0, openid, profile, email, and 401 Unauthorized...
The entire operation concludes with the removal of temporary artifacts to hinder post-compromise analysis.
After the upload is completed, the sample deletes the temporary directory and archive file: rm -rf /tmp/lksopo rm -f /tmp/lksopo.zip
After decoding, the actual curl invocation is revealed, using flags such as -sLSkf (silent execution, following redirects, and ignoring TLS errors) to retrieve and execute a remote script via zsh.
AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.
Stealth and persistence Hides its execution by setting the Terminal window to invisible.
The final payload is retrieved and executed in memory (IEX)... The malware constructs a final textual payload that is passed directly to the /bin/zsh interpreter via a pipe and fork mechanism. This means the entire execution occurs in memory, without generating persistent filesystem artifacts.
Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.
Its primary targets include browser credentials and cookies... The sample attempts to copy Safari cookies from the following locations... Cookies.binarycookies
The sample first reads the USER environment variable and checks whether the current user is root.
The system information collection commands include: sw_vers -productVersion | cut -d. -f1 ... system_profiler SPSoftwareDataType SPHardwareDataType SPDisplaysDataType
It also traverses directories associated with Chromium- and Gecko-based browsers... The wallet targets identified from the decrypted strings include: Electrum, Electrum-LTC, Coinomi, Exodus...
File Grabber : Collects files with specific extensions (e.g., .txt, .pdf, .docx, .wallet, .key) from Desktop, Documents, and Downloads folders
452 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Other indicator types observed in public reporting.
178 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
A macOS stealer observed being delivered through ClickFix lures.
Mentioned as a comparative example of recent macOS stealer activity targeting Mac endpoints via the web.
Mentioned as another macOS infostealer seen in related ClickFix campaigns.
Referenced as an example of existing macOS malware in background context only.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.