Atomic Stealer

Last year, we documented malware distribution campaigns both via malvertising and compromised sites delivering Atomic Stealer (AMOS) onto Mac users... on January 8, we identified a malvertising campaign... The threat actors are luring victims via a Google search ad impersonating Slack

...a silent password validation attempt using macOS directory-service commands, and—if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” ... If it matches, the malware captures the user’s login password in cleartext.

Victims are directed to high-fidelity, deceptive web interfaces that simulate legitimate services.

A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware... The site, openew[.]app, closely mimics OpenAI’s real ChatGPT download experience and offers what appear to be official desktop apps for both Windows and macOS.

Initial commands leverage curl to fetch obfuscated payloads, which are piped directly into shell interpreters (bash/zsh), minimizing the disk footprint.

ClickFix variant that uses the applescript:// URL scheme to invoke the macOS Script Editor... This URL-encoded hyperlink runs a dual-track routine... while silently executing the curl command in the background to deliver an infostealer, bypassing Gatekeeper via user-coerced interaction.

containing a curl command that downloads and executes malware.

Clicking the Windows download delivers a fake installer... Clicking the macOS button delivers malware... When the victim runs the installer...

Attackers exploit this trust by providing malicious command strings that mimic legitimate installation procedures.

The earliest examples used shared Claude.ai conversations disguised as installation guides... that walked users through opening a terminal and pasting a curl command that downloaded and executed an infostealer.

It also attempts to replace legitimate Ledger and Trezor wallet apps with trojanized versions.

...a silent password validation attempt using macOS directory-service commands, and—if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” ... If it matches, the malware captures the user’s login password in cleartext.

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

...a silent password validation attempt using macOS directory-service commands, and—if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” ... If it matches, the malware captures the user’s login password in cleartext.

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

It looks like Atomic Stealer was updated around mid to late December 2023, where its developers introduced payload encryption in an effort to bypass detection rules... using a new encryption routine that hides strings of interest

Long-term access is secured via LaunchAgents and .plist files, often masquerading as legitimate system or software updaters.

...a silent password validation attempt using macOS directory-service commands, and—if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” ... If it matches, the malware captures the user’s login password in cleartext.

The threat actors are leveraging tracking templates to filter traffic and route it through a few redirects before loading the landing page

It also attempts to replace legitimate Ledger and Trezor wallet apps with trojanized versions.

...if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” complete with the familiar lock icon. Whatever the user types is validated against the same command. If it matches, the malware captures the user’s login password in cleartext.

Instead of logging keystrokes, the malware displays deceptive dialog boxes requesting the user’s credentials.

Exfiltration efforts focus on high-value data, including ... messaging session tokens (Telegram/Discord)

It copies the macOS keychain, harvests cookies and saved logins from 12 Chromium-based browsers plus Firefox and Waterfox, and extracts Telegram session data.

Exfiltration efforts focus on high-value data, including browser credentials (Chromium/Firefox), macOS Keychains

Exfiltration efforts focus on high-value data, including ... macOS Keychains

Exfiltration efforts focus on high-value data, including browser credentials (Chromium/Firefox)

Subsequent stages often involve a native-looking password prompt to facilitate credential harvesting under the guise of installation continuity.

It also scans 16 cryptocurrency wallet directories, including Ledger Live, Trezor Suite, Exodus, Electrum, and Sparrow. Finally, it searches Desktop and Documents folders for files with extensions like .wallet, .seed, .key, and .kdbx.

The threat actors are leveraging tracking templates to filter traffic and route it through a few redirects before loading the landing page

This will allow Atomic Stealer to collect passwords and other sensitive files that are typically access-restricted... Stealing victim passwords, crypto wallets and cookies

...if that silent check fails—a fake macOS-style prompt reading “Please enter device password to continue,” complete with the familiar lock icon. Whatever the user types is validated against the same command. If it matches, the malware captures the user’s login password in cleartext.

Instead of logging keystrokes, the malware displays deceptive dialog boxes requesting the user’s credentials.

The collected data is compressed into a temporary archive and sent to a hardcoded server.

Initial commands leverage curl to fetch obfuscated payloads

When we analyzed this sample in a sandbox we saw the data exfiltration taking place and the corresponding C2 server

By presenting deceptive "fixes," "verifications," or installation prompts, adversaries induce users to manually execute malicious scripts via native utilities such as the Terminal or Script Editor.