Amos Stealer

AMOS Stealer is a malicious software (malware) that was first identified in early 2023, specifically targeting macOS. This harmful program infiltrates systems through suspicious downloads, emails, or websites, often without the user's knowledge. Once inside, it can steal personal information, disrupt operations, or even hold data hostage for ransom. A notable feature of AMOS Stealer is its ability to impersonate legitimate macOS applications such as CleanShotX, 1Password, and Bartender, luring users into downloading the malware. In an investigation conducted by Recorded Future’s Insikt Group, 12 websites were discovered that mimicked these legitimate applications. A new variant of AMOS Stealer surfaced later, showing significant similarities with the second variant of RustDoor, another malware. This variant employs Apple Script, similar to Atomic Stealer, a different strain of malware. The use of Apple Script indicates a high level of adaptability and convenience in deploying the malware, raising serious concerns about its potential impact. This new variant has been found to target Safari cookies and crypto wallets, posing a significant threat to privacy and financial security. The AMOS Stealer has also been linked to cybercriminal activities involving cryptocurrencies. Reports suggest that hackers have been breaking into email accounts to steal cryptocurrency, leveraging the capabilities of this malware. Furthermore, there's evidence of threat actors selling the new Atomic MacOS AMOS Stealer on platforms like Telegram. This wide range of tactics and targets underlines the versatility and threat posed by the AMOS Stealer to individual and organizational cybersecurity.