Atomic Stealer

Atomic Stealer is a malicious software (malware) known for its ability to exploit and damage computer systems, often infiltrating through suspicious downloads, emails, or websites. It is designed to steal personal information, disrupt operations, and even hold data hostage for ransom. A new version of this malware is being delivered via a malvertising campaign specifically targeting macOS users. This campaign utilizes seemingly innocuous prompts for program installation to gain access to keychain passwords and important files. In recent developments, as of June 27, 2024, a competitor of Atomic Stealer has emerged, launching a new campaign to attract more victims. Known as Rodrigo4 in the XSS underground forum, this threat actor is developing a stealer with features and code base similar to the infamous Atomic Stealer. The macOS stealer being dropped in this latest campaign is actively being developed as an Atomic Stealer competitor, sharing a large part of its predecessor's code base. To counter these threats, Insikt Group recommends using intelligence and monitoring platforms that scan for malicious domains and IP addresses associated with Atomic Stealer and other macOS malware. Notably, Microsoft Teams has become a popular keyword that threat actors are bidding on, marking the first time it has been used by Atomic Stealer. By staying vigilant and employing preventive measures, users can better protect themselves from such malware attacks.