AMOSMalware
- atomic macos stealer
Last reported 5 days ago, by The Hacker News31 reports
ATT&CK techniques
6 of 96 · each with the sentence it comes from- T1684Social Engineering
“…SH crypto-draining affiliate group, GlowComa promotes ICMacOS as part of a broader “ICARUS” suite that includes an ICARUS ClickFix social engineering panel and a multi-chain crypto clipper, often bundling the tools to attract affiliates.”
- T1036Masquerading
“Masquerading: Match Legitimate Resource Name or Location”
- T1053.005Scheduled Task
“…ses a legitimate, Canon-signed application to sideload malicious code, then sets up two persistence mechanisms, a User Run key and a scheduled task, both named Canon Configuration Reader.”
- T1176.001Browser Extensions
“…n and then harvests system information, clipboard text, process listings, Wi-Fi profile names, screenshots, and data from wallets, browser extensions, messengers, remote-access and file transfer protocol (FTP) applications, virtual private network (VPN) clients, browsers (Google…”
- T1553.002Code Signing
“… usually considered rare and advanced: the system’s built-in protections like Gatekeeper, TCC, System Integrity Protection, mandatory code signing and lower number of users require higher commitments and bring less profit for the attackers compared to other platforms.”
- T1567Exfiltration Over Web Service
“T1567”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
31 reports · the newest 20, newest first · the exact sentence from each-
Fake Web3 Accelerator Uses npm Packages to Spread Malware and Hijack AI Agent Traffic“…d three other npm packages linked to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family -”
-
Inside ICMacOS: From an Infostealer to a Persistent RAT“…vice and sophisticated threat actors alike, the Malware-as-a-Service (MaaS) model has accelerated the spread of specialized stealers like AMOS, MacSync, and Cthulhu.”
-
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix“…poisoned ChatGPT and Grok conversations posed as macOS troubleshooting advice and tricked users into running commands that downloaded the AMOS stealer”
-
A Closer Look at Malware From the Macfinger ClickFix Campaign, (Fri, Sep 25th)“The more I look into the malware delivered by this campaign, the more I believe it is not a variant of Atomic macOS (AMOS) Stealer as originally reported.”
-
MacSync info-stealing malware hides malicious commands in an iCloud calendar“Early versions used AppleScripts that closely resembled the AMOS stealer, while newer variants added a backdoor module.”
-
Macfinger ClickFix campaign, (Tue, Sep 22nd)“The Ransom-ISAC article on this activity calls the final malware a variant of Atomic macOS (AMOS) Stealer.”
-
HBO Max ads on a compromised Reddit account exposed a massive PasteSwitch ClickFix operation“The macOS Branch: MacSync, AMOS, and Fake Wallets”
-
Infostealer secuestra sesiones de Claude y consume créditos sin autorización“…n la campaña, como Vidar, Lumma (LummaC2), StealC, RedLine y Acreed, que atacan sistemas Windows, además de Atomic Stealer (AMOS), encontrado en un pequeño número de equipos Mac.”
-
Fake Codex Download Uses Google Sites to Deliver macOS Malware“AMOS Delivery Framework Shows Strong Overlap”
-
Def Con Attendees Targeted by Persistent Phishing Campaign“For macOS it was an infostealer known as AMOS.”
-
Novel macOS Infostealer AmnesiaStealer Spread via ClickFix“While its objectives overlap with other macOS infostealers such as Atomic (AMOS), MacSync and CrashStealer, the researchers noted that AmnesiaStealer has macOS-specific capabilities that make it a novel threat.”
-
Cloud and SaaS Environments Now Top Targets for Attackers“Atatckers were also observed abusing legitimate blockchain infrastructure to distribute infostealers, including AMOS and Phexia.”
-
Reverse Engineering the Six Stages of MacSync Stealer and RAT“Huntress previously documented cases of AMOS Stealer delivered through poisoned ChatGPT and Grok conversations, and SectopRAT delivered through a fake Claude desktop malvertising campaign.”
-
ClickLock Stealer: Paste Once, Lose Everything“Although the macOS threat landscape has grown considerably in recent years, with malware like Atomic Stealer (AMOS), Banshee Stealer, Poseidon, Cuckoo, Cthulhu Stealer and MacStealer, the total number of known macOS malware families remains relatively small in contrast to other s…”
-
Deceptive Installers: How Fake Apps Target macOS“This is the most common pattern, used by AMOS, Poseidon, Odyssey, and MacSync.”
-
Social Engineering Leveled Up. Has Your Security Program?“The moment they followed the instructions, they executed malicious commands that installed the AMOS infostealer malware.”
-
Attackers Didn’t Wait for AI. They Built Workflows Around It.“In a recent AMOS stealer campaign, users searching for something as routine as “clear disk space on macOS” were served results that looked like ChatGPT or Grok conversations.”
-
JSAC2026 -Workshop/Lightning Talk Session/Panel Discussion-“On Windows systems, this resulted in the execution of malware including HijackLoader, while on macOS systems, it led to infection with AMOS Stealer.”
-
How Fake OpenClaw Installers Spread GhostSocks Malware“…nstance, attackers poisoned search results and exploited the shared chat features of ChatGPT and Grok to trick users into downloading the AMOS stealer, whereas in this instance just hosting the malware on GitHub was enough to poison Bing AI search results.”
-
AI-Poisoning & AMOS Stealer: The Biggest Mac Threat“AI-Poisoning & AMOS Stealer: The Biggest Mac Threat”
Indicators in its reports
named in the reports above- terminal[.]appin 2 reports
- wallet[.]appin 2 reports
- 95.163.153[.]80in 2 reports
- com[.]applein 1 report
Copy these 4 indicators · defanged
Thanks — we review every report.