Atomic macOS (AMOS) Stealer Activity

This report details an analysis of the Atomic macOS (AMOS) stealer malware, observed in a lab environment on August 5, 2026. AMOS stealer is distributed via malicious websites and cracked software campaigns, using social engineering to trick users into pasting malicious commands into Terminal. The infection chain involves downloading a Zsh script that retrieves and executes a Mach-O binary, which establishes persistence and collects sensitive data including credentials, browser data, cryptocurrency wallets, and messaging app data. Exfiltration occurs via HTTP POST requests to command and control servers, with infrastructure and indicators frequently changing, indicating active development and evasion tactics.

AI-extracted · verify before operational use