Atomic Macos Stealer

The Atomic macOS Stealer (AMOS) is a powerful new malware that emerged in early 2023, targeting Apple users. It was discovered by Cyble Research and Intelligence Labs (CRIL) in April of the same year when it was advertised for sale on Telegram. AMOS can steal various types of information from infected machines, including Keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password. This malware has since become a growing threat to macOS users. AMOS was part of an extensive campaign aimed at cryptocurrency theft and was delivered alongside other infostealers such as Rhadamanthys and Stealc in cross-platform attacks. These infostealers were hidden in fake browser updates or disguised as legitimate software, targeting both Intel- and ARM-based devices depending on the victim's operating system. The use of these deceptive tactics made it more difficult for users to recognize and avoid the threat. From its discovery until December 31, 2023, a subscription to the Atomic macOS Stealer was sold for $2000, making it accessible to malicious parties seeking to exploit macOS users. Despite its high cost, the malware was popular due to its effectiveness and the potential financial gain for those using it for illicit purposes. As such, AMOS represents a significant cybersecurity threat that requires ongoing vigilance and robust protective measures.