Atomic Stealer

The Atomic Stealer is a type of malware that poses a significant threat to macOS devices. This malicious software infiltrates systems, often unbeknownst to the user, through suspicious downloads, emails, or websites. Once installed, it has the potential to steal personal information, disrupt operations, or hold data for ransom. A recent malvertising campaign has been identified as delivering a new version of the macOS Atomic Stealer. This campaign demonstrates the evolving nature of this threat and highlights the need for ongoing vigilance and robust cybersecurity measures. Several other macOS infostealers, such as the Atomic Stealer aka Amos, and RealStealer, have been spotted in the past year, according to SentinelOne. These variants contain Mach-O binaries that target specific browser extensions, further extending their reach and potential damage. The newly discovered variant of Atomic Stealer uses an Apple Script block that shows a high level of similarity with the second variant of RustDoor, another malware. Moreover, Cthulhu Stealer, a malware with similar functionality to Atomic Stealer, has led experts to speculate that both were likely created by the same developer. Despite macOS threats being less common than those to Windows and Linux, organizations with a significant number of macOS devices are likely at risk of having Atomic Stealer present in their environment. Data from 2022 and 2023 suggest that approximately 6% of all malware can be found on these systems. Atomic Stealer's consistent presence in Red Canary's top 10 lists throughout 2024 underscores its persistent threat. While not remarkable in itself, Atomic Stealer has paved the way for other malware like Cthulhu Stealer, which closely mimics its features, indicating the potential for future, similar threats.