Family comparison

MacSync StealerAtomic macOS Stealer (AMOS)Poseidon Stealer
Capability
MacSync StealerActive
Atomic macOS Stealer (AMOS)Active
Poseidon StealerActive
PlatformmacOSmacOSmacOS
Dark Radar infection records60,88533,6057,177
Credentials
Browser passwordsVerifiedVerifiedVerified
Session cookiesVerifiedVerifiedDark Radar observation
Refreshing expired sessions———
AutofillVerifiedVerifiedDark Radar observation
macOS KeychainVerifiedVerifiedVerified
2FA and password managers———
Financial
Saved cardsDark Radar observationVerifiedDark Radar observation
Desktop crypto walletsVerifiedVerifiedVerified
Wallet extensionsVerifiedVerified—
Clipboard address replacement———
Applications
Email clients———
FTP clients———
VPN clients——Reported
Messaging applications—Version-dependent—
Gaming platforms———
System
File collectionVerifiedVerifiedVerified
Screenshot———
System inventoryDark Radar observationVerifiedDark Radar observation
Behavior
Additional payload downloadVerified——
PersistenceVerified——
Anti-analysis———
Verified
Version-dependent
Reported
Dark Radar observation
Not observed