Mac Stealers Cuckoo and Atomic Stealer Spread via Fake Homebrew and Malvertising
Malware Intelligence · 2 sources · Updated 4mo ago · First seen May 25, 2026
Researchers reported active distribution of multiple macOS information stealers, including newly identified Cuckoo malware and an updated Atomic Stealer (AMOS), through social engineering that impersonates trusted software. Intego said Cuckoo was disguised as Homebrew, while Malwarebytes documented Atomic Stealer being delivered through crack sites and a Google malvertising campaign that spoofed Slack for Mac users and dropped FakeBat on Windows systems.
The campaigns were designed to harvest sensitive data from Apple devices by tricking users into opening malicious DMG files and entering their system password. Malwarebytes said the latest AMOS build added payload encryption and string obfuscation to hinder detection, and was capable of stealing passwords, browser cookies, cryptocurrency wallet data, and other files, with exfiltration observed to 5.42.65[.]108. The reporting shows continued commercial development of macOS stealers and a growing use of fake software branding to target Mac users.
