Atomic Stealer Amos

Atomic Stealer Amos is a software vulnerability that was discovered in 2023, designed to exploit macOS devices. This flaw in software design or implementation was used by cybercriminals to spread malware to Mac users, primarily through malicious advertising and compromised websites. The malware was developed by a threat actor known as Rodrigo4 in the XSS underground forum, who created a stealer with features and code base similar to the infamous Atomic Stealer (AMOS). In September 2023, Malwarebytes documented a significant campaign distributing this malware via malvertising. The same domain also contained an open directory showing the location of both the Windows payload, a MSI installer known as FakeBat, and the Mac payload, Atomic Stealer (AMOS). In addition to these campaigns, a fake browser update campaign named 'ClearFake' expanded its operations to macOS, specifically targeting Apple computers with the Atomic Stealer (AMOS) malware. The Atomic Stealer (AMOS) malware also evolved over time, with updated versions being pushed to both Windows and Mac systems. On Windows machines, Lumma Stealer was installed, while on Macs, the Atomic Stealer (AMOS) was deployed. Despite its recent introduction, the Atomic Stealer (AMOS) for Mac has quickly gained popularity among threat actors, highlighting the ongoing risk it poses to macOS users.