Search: “Atomic Stealer (AMOS)”

59 stories

Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.

Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.

Palo Alto Unit 4210:00 UTC · 3h agoMalware in the wild

ClearFake campaign spreads macOS AMOS information stealer

Security AffairsNov 23, 20:51 UTC · Nov 23, 2023Malware

A malvertising campaign is delivering a new version of macOS Atomic Stealer

Security AffairsSep 7, 16:48 UTC · Sep 7, 2023Malware

GitCaught: Threat Actor Leverages GitHub Repository for Malicious Infrastructure

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Threat actor

Atomic Stealer MacOS ClickFix Attack Bypasses Apple Security Warnings

Infosecurity MagazineApr 9, 11:20 UTC · Apr 9, 2026Malware

The Travels of “markopolo”: Self-Proclaimed Meeting Software Vortax Spreads Infostealers, Unveils Expansive Network of Malicious macOS Applications

Recorded FutureAug 22, 00:00 UTC · Aug 22, 2025Malware

GitCaught campaign relies on Github and Filezilla to deliver multiple malware

Security AffairsMay 20, 14:20 UTC · May 20, 2024Malware

Researchers Find 341 Malicious ClawHub Skills Stealing Data from OpenClaw Users

The Hacker NewsFeb 4, 05:15 UTC · Feb 4, 2026Malware

Anthropic locks out Claude users after infostealers hijack login sessions

Anthropic invalidated Claude sessions compromised by infostealers such as Vidar, Lumma and Atomic Stealer, which steal browser cookies to bypass 2FA.

Anthropic began locking users out of Claude accounts after infostealer malware stole browser session cookies, letting attackers replay logins and bypass two-factor authentication. Identified malware includes Vidar, Lumma (LummaC2), StealC, RedLine and Acreed on Windows and Atomic Stealer (AMOS) on a small number of Macs. Anthropic signed affected users out, removed saved payment methods and refunded unauthorized charges. One affected user traced the infection to a pirated game downloaded from a Russian underground forum; the company advised victims to remove the malware before resetting passwords and re-enabling 2FA.

Help Net SecurityAug 31, 00:00 UTC · 16d agoData breach in the wild1

Microsoft Links 30+ Rotating Domains to MacSync Stealer Infrastructure

Microsoft links 30+ rotating domains to the MacSync macOS infostealer, confirming active credential and file exfiltration through chunked HTTP PUT uploads.

Microsoft Defender Experts correlated 30+ domains with MacSync Stealer, requiring aligned endpoint and network behaviors (process ancestry, command-line patterns, /curl/, /dynamic?txd=, and /gate?buildtxd= paths, API-key headers, chunked HTTP PUT parameters) to link infrastructure. Execution begins from an interactive zsh session consistent with ClickFix social engineering, with curl retrieving and Base64/gunzip decoding the payload, followed by collection of Keychain data, browser credentials, SSH keys, AWS credentials, Kubernetes configs, and Apple Notes. Data is zipped to /tmp/osalogging.zip, chunked, uploaded via HTTP PUT, and artifacts are deleted afterward; the analysis builds on RST Cloud's May 8 findings and overlaps with Microsoft's earlier 250+ domain ClickFix campaign distributing MacSync and Atomic Stealer (AMOS).

The Hacker NewsAug 19, 06:01 UTC · 28d agoMalware in the wild

Over 250 ClickFix Domains Use Browser Fingerprinting to Hide macOS Malware Lures

The Hacker NewsAug 5, 18:44 UTC · Aug 5, 2026Malware

ClickFix Now Cybercriminals' Favorite Malware Delivery Technique

Infosecurity MagazineJun 30, 12:00 UTC · Jun 30, 2026Malware

Ongoing malvertising campaign targets European IT workers with fake GitHub Desktop installers

Help Net SecuritySep 9, 00:00 UTC · Sep 9, 2025Threat actor

Over 300 entities hit by a variant of Atomic macOS Stealer in recent campaign

Security AffairsAug 23, 07:07 UTC · Aug 23, 2025Malware

ClickFix campaign delivers Mac malware via fake Apple page

Help Net SecurityApr 10, 00:00 UTC · Apr 10, 2026Malware

Mac Users Beware: Malvertising Campaign Spreads Atomic Stealer macOS Malware

The Hacker NewsSep 11, 13:07 UTC · Sep 11, 2023Malware

MacOS Infostealer AMOS Evolves with Backdoor for Persistent Access

Infosecurity MagazineJul 9, 11:00 UTC · Jul 9, 2025Malware

Atomic macOS Stealer is advertised on Telegram for $K per month

Security AffairsApr 29, 18:09 UTC · Apr 29, 2023Malware

⚡ Weekly Recap: Scattered Spider Arrests, Car Exploits, macOS Malware, Fortinet RCE and More

The Hacker NewsJul 15, 00:00 UTC · Jul 15, 2025Ransomware CVE-2025-25257 CVE-2025-25251 CVE-2025-31365+36 CVEs1

AI-Powered Rhadamanthys Stealer Targets Crypto Wallets with Image Recognition

The Hacker NewsOct 2, 05:17 UTC · Oct 2, 2024Malware

ClearFake Campaign Expands to Target Mac Systems with Atomic Stealer

The Hacker NewsNov 23, 12:40 UTC · Nov 23, 2023Malware

New Atomic macOS Stealer Campaign Exploits ClickFix to Target Apple Users

The Hacker NewsJun 7, 05:50 UTC · Jun 7, 2025Malware

Clever macOS malware delivery campaign targets cryptocurrency users

Help Net SecurityJun 19, 00:00 UTC · Jun 19, 2024Malware

Security Affairs newsletter Round 417 by Pierluigi Paganini

Security AffairsApr 30, 09:55 UTC · Apr 30, 2023Ransomware in the wildCVE-2023-27350 CVE-2023-27524 CVE-2023-1389+1 CVEs

Marko Polo cybercrime gang targets cryptocurrency users, influencers with scams

The RecordSep 17, 14:46 UTC · Sep 17, 2024Phishing & fraud

New macOS infostealer impersonates Apple, Microsoft, and Google in a single attack chain

Help Net SecurityMay 19, 00:00 UTC · May 19, 2026Malware

Microsoft: Info-Stealing malware expands from Windows to macOS

Security AffairsFeb 4, 11:30 UTC · Feb 4, 2026Malware

Microsoft Discloses DNS-Based ClickFix Attack Using Nslookup for Malware Staging

The Hacker NewsFeb 15, 00:00 UTC · Feb 15, 2026Malware

Cybercriminal Campaign Spreads Infostealers, Highlighting Risks to Web3 Gaming

Recorded FutureOct 31, 00:00 UTC · Oct 31, 2023Malware

Fake OpenAI Codex download tricks macOS users into installing malware

Cato Networks uncovered a malware campaign using sponsored search ads and fake OpenAI Codex pages to deliver an AMOS-like infostealer to macOS users.

Cato Networks researchers discovered a campaign using sponsored search results and a fake OpenAI Codex download portal on Google Sites to lure macOS users. Victims are instructed to paste a Terminal command that decodes a Base64-encoded URL and runs a multi-stage infection chain ending in a universal Mach-O binary. The delivery chain closely resembles Atomic macOS Stealer (AMOS), and related infrastructure impersonating Claude Code was also found. Operators use iframe-based hosting and path/device gating to evade analysts and automated scanners.

Help Net SecurityAug 25, 00:00 UTC · 22d agoMalware in the wild