Active threat familymacOSCredential theft
Malware Intelligence

Atomic macOS Stealer (AMOS)

AMOS is a macOS infostealer sold by subscription on Telegram. It asks the user for their password through a fake system window, uses that password to unlock the Keychain, then archives and sends browser data, wallets and documents.

Activity map

Activity mapDownloadUserWith passwordPackagingExfiltrationUser pastesDownloadsSponsoredsearch adPopular Mac applicationFake download siteCopy of an application si…DMGDisk imageRight-click > OpenGatekeeper bypassosascriptFake password windowAtomic macOSStealerInfostealerData collection11 targetsLog archiveC2 serverFake GitHub PagesWell-known brand nameTerminalcurl | bashDownload from aremote serverInstallation script
Executable payloadFile
Malicious payloadAtomic macOS Stealer · Infostealer

AMOS is a macOS infostealer sold by subscription on Telegram. It asks the user for their password through a fake system window, uses that password to unlock the Keychain, then archives and sends browser data, wallets and documents.

Appears in flows

Environment information

  • Operating system
  • Hardware
  • IP and location
  • Installed software
  • Desktop files

Credentials and application data

  • Saved passwords
  • Session cookies
  • Autofill
  • Saved cards
  • Keychain
  • MetaMask
  • Ledger Live
  • Phantom
  • Telegram
  • Coinbase Wallet
  • Exodus
  • Electrum
Dark Radar infection records
33,605
Latest infection record
26 September 2026
Malware type
Infostealer
First seen
April 2023
01

Overview

It is the most widespread stealer family targeting macOS; the assumption that "Macs don't get viruses" leaves endpoint protection weak in organizations.

Ranks 25 of 52 families in Dark Radar data, with 33,605 infection records.

Other names: AMOS, Atomic Stealer

02

Origin and evolution

  1. April 2023Went on sale on Telegram.Malpedia (Fraunhofer FKIE)
  2. September 2023Distributed from fake application download pages promoted with sponsored ads.Malwarebytes
  3. January 2024A new version with updated obfuscation spread.Malwarebytes
  4. 2024The developer put a second variant on sale through the same channel.SentinelOne
03

Technical profile

Malware typeInfostealer
Target operating systemmacOS
Primary purposeKeychain and wallet theft
Threat categoryCredential theft
Programming languageObjective-C / Go; AppleScript payloads
Distribution modelSubscription via Telegram (MaaS)
First seenApril 2023
Infected systemsmacOS 63.5%
Public source confidenceHigh
04

Targeted applications

11 applications6 categories
05

Data collection

Credentials

  • Browser passwords99.5%Verified
  • Session cookies91.5%Verified
  • Refreshing expired sessions—
  • Autofill89.5%Verified
  • macOS Keychain40.5%Verified
  • 2FA and password managers—

Financial

  • Saved cards22%Verified
  • Desktop crypto wallets15.5%Verified
  • Wallet extensions11.5%Verified
  • Clipboard address replacement—

Applications

  • Email clients—
  • FTP clients—
  • VPN clients—
  • Messaging applicationsVersion-dependent
  • Gaming platforms—

System

  • File collectionVerified
  • Screenshot—
  • System inventory71%Verified
06

File system

User folder (~)
File details are in Dark Radar IntelligenceOpen in Intelligence
07

System components

  • Hardware and operating system information via system_profiler
  • Verification of the user password with dscl
08

How it works

  1. 1Infection

    • Fake application DMG files (sponsored search ads, fake GitHub repositories).
    • The user is asked to "Right-click > Open" to bypass the Gatekeeper warning.
    T1189Drive-by Compromise

    Breaking point: Email attachments, sponsored ad links and unlicensed software downloads are blocked at the email and web gateway.

  2. 2Execution and evasion

    • A password window styled as "System Settings" is shown with AppleScript.
    T1204.002User Execution: Malicious FileT1059.002AppleScript

    Breaking point: Only signed and notarized applications are allowed; processes requesting passwords through osascript are monitored.

  3. 3Discovery

    • Hardware and system information is collected.
    Dark Radar observation

    Infected systems: macOS 63.5%.

    T1082System Information Discovery

    Breaking point: Bulk system and security software queries from a short-lived process trigger an EDR alert.

  4. 4Data collection

    • The Keychain, browser profiles, wallets, Notes and documents with certain extensions are copied.
    Dark Radar observation

    Data found in the latest 200 logs: password file 99.5%, cookies 91.5%, autofill 89.5%, cards 22%, wallets 15.5%.

    T1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1005Data from Local SystemT1560Archive Collected Data

    Breaking point: A process other than the browser reading browser profile files is blocked or triggers an alert.

  5. 5Exfiltration and C2

    • Data is placed in a ZIP archive and sent with HTTP POST.
    T1071.001Web ProtocolsT1041Exfiltration Over C2 Channel

    Breaking point: Traffic to newly registered domains, direct IP addresses and non-standard ports is blocked.

09

Network communication

This section is in Dark Radar IntelligenceOpen in Intelligence
10

MITRE ATT&CK

Initial Access
Execution
Credential Access
Discovery
Collection
Command and Control
Exfiltration
11

IOCs and detection

This section is in Dark Radar IntelligenceOpen in Intelligence
12

Risk and impact

  • When the Keychain is taken together with the user password, every saved password on the device is exposed.
  • Stolen session cookies are enough to take over cloud, email and SaaS sessions without a password or multi-factor authentication prompt.
  • Corporate passwords saved on personal devices also leak through infections outside the corporate network; these logs are sold to initial access brokers.
  • Log archives are reshared for years; as long as the password is not changed, the same credential can be used again and again.
  • Compromised email, messaging and social media accounts become the next link in phishing and malware distribution.
13

Defense

  • Allow only App Store or signed and notarized applications.
  • Install EDR on macOS endpoints too; monitor processes that request passwords through osascript.
  • When an infection is detected, revoke not only the password but all related sessions and access tokens.
  • Turn off password saving in the browser through corporate policy; use a corporate password manager.
  • Move to phishing-resistant multi-factor authentication (FIDO2/passkey); bind sessions to the device.
  • Block setup files downloaded from unlicensed software, game cheats and sponsored search results.
  • Monitor flows where the user runs a command by pasting it into the Run dialog or terminal (ClickFix) with endpoint rules.
  • Continuously monitor your corporate domains and employee email addresses in stealer logs with Dark Radar.
14

Learning center

How does this malware spread?
  • Fake application DMG files (sponsored search ads, fake GitHub repositories).
  • The user is asked to "Right-click > Open" to bypass the Gatekeeper warning.
How can its presence on a system be detected?
  • Sign-ins to accounts from an unrecognized country or device.
  • A new infostealer log in Dark Radar for your corporate domain or an employee email address.
Which macOS artifacts should be examined?
  • DMG files under ~/Downloads and the com.apple.quarantine attribute.
  • The user's Terminal history (~/.zsh_history).
  • Temporary ZIP archives under /tmp.
  • New plist files under ~/Library/LaunchAgents.
Which log records matter?
  • Unified log (log show)osascript processes and dialog boxes asking the user for a password.
  • TCC databaseFull Disk Access permission granted to Terminal or an unknown application.
  • Endpoint Security Framework (ESF)Processes accessing the Keychain file and browser profiles.
  • ~/.zshrc, LaunchAgentsLines and plist files added for persistence.
Which MITRE techniques is it associated with?
T1189Drive-by CompromiseT1204.002User Execution: Malicious FileT1059.002AppleScriptT1056.002GUI Input CaptureT1555.001KeychainT1555.003Credentials from Web BrowsersT1539Steal Web Session CookieT1082System Information DiscoveryT1005Data from Local SystemT1560Archive Collected DataT1071.001Web ProtocolsT1041Exfiltration Over C2 Channel
How should a SOC analyst respond?
  1. Isolate the device from the network; do not reinstall it before taking memory and disk images.
  2. Determine the infection date; list all accounts that were signed in on the device after that date.
  3. Change the passwords of these accounts, revoke their sessions and access tokens, and re-enroll multi-factor authentication devices.
  4. Search identity provider and SaaS logs for new country, device and token usage after the infection.
  5. If a recovery phrase or wallet file was exposed, move the assets to a new wallet.
  6. Find the initial access path (email, ad, unlicensed software, fake CAPTCHA) and check other users who used the same path.
  7. Reinstall the device from a clean image.
15

Sources

Related families

Poseidon StealerMacSync StealerCompare

Related terms

Malware-as-a-ServiceMalvertising
From the Essential plan

Infostealer Detection

See your firm's attack surface on one screen: how many findings, at which severity, on which domain.

View productCompare plans