Atomic macOS Stealer expands via Telegram MaaS and ClickFix social engineering

Atomic macOS Stealer (AMOS) has emerged as a leading macOS infostealer sold as a malware-as-a-service offering on Telegram and used in campaigns that rely heavily on social engineering rather than exploits. Researchers found the Golang-based malware distributed in forms including malicious DMG installers and ClickFix-style lures that trick users into running Terminal commands, after which it captures or validates the victim’s macOS password, steals Keychain contents, browser credentials, cookies, autofill data, files, Apple Notes, extension storage, session tokens, system information, and cryptocurrency wallet data, then exfiltrates the results to attacker-controlled infrastructure and, in earlier observed versions, Telegram. Operators have advertised AMOS for $1,000 per month alongside add-on services such as a victim panel, crypto tooling, and installer support.

Sophos said AMOS accounted for nearly 40% of its macOS protection updates in 2025 and almost half of recent macOS stealer cases seen by customers, underscoring its scale and persistence. In one investigated intrusion, a bootstrap script fetched from sphereou[.]com downloaded a second-stage payload, performed anti-analysis checks, registered with command-and-control, and established persistence through a LaunchDaemon after obtaining elevated access. Earlier reporting tied AMOS infrastructure to amos-malware[.]ru, with exfiltration observed to /sendlog, while newer variants increasingly use AI-themed lures, fake installers, cracked apps, repeated password prompts, and fake Ledger and Trezor modules to broaden credential theft and cryptocurrency targeting.