Family comparison

Atomic macOS Stealer (AMOS)Poseidon StealerMacSync Stealer
Capability
Atomic macOS Stealer (AMOS)Active
Poseidon StealerActive
MacSync StealerActive
PlatformmacOSmacOSmacOS
Dark Radar infection records33,6057,17760,885
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedDark Radar observationVerified
Refreshing expired sessions———
AutofillVerifiedDark Radar observationVerified
macOS KeychainVerifiedVerifiedVerified
2FA and password managers———
Financial
Saved cardsVerifiedDark Radar observationDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerified—Verified
Clipboard address replacement———
Applications
Email clients———
FTP clients———
VPN clients—Reported—
Messaging applicationsVersion-dependent——
Gaming platforms———
System
File collectionVerifiedVerifiedVerified
Screenshot———
System inventoryVerifiedDark Radar observationDark Radar observation
Behavior
Additional payload download——Verified
Persistence——Verified
Anti-analysis———
Verified
Version-dependent
Reported
Dark Radar observation
Not observed