AMOS Mac Malware Spreads via Fake Ads and Trojanized macOS Downloads

Researchers reported multiple campaigns distributing macOS infostealers tied to the AMOS/AtomicStealer ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and Keychain material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels.

More recent campaigns used malvertising and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as "malext". Investigators said the malware used obfuscated shell commands, osascript, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake CleanMyMac sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.