Loading malware…
Atomic Stealer, also known as AMOS, is a macOS-focused information-stealing malware family associated with financially motivated cybercrime activity and commonly discussed as part of the growing ecosystem of macOS stealers. It is designed to harvest sensitive data from infected Apple systems, including browser-stored credentials, cookies and other session material, cryptocurrency wallet data, and related user information. The malware is frequently referenced alongside other macOS stealers such as MacSync, CrashStealer, Poseidon, Banshee, and Odyssey, reflecting overlapping objectives in credential and wallet theft.
Atomic Stealer has been observed in multiple social-engineering and malware distribution schemes targeting macOS users. Reported delivery patterns include ClickFix-style paste-and-run lures, fake download pages impersonating trusted developer tools or software resources, malicious GitHub repositories posing as installers, and campaigns tied to free or cracked software and malicious advertising. It has also been distributed through deceptive templates reused across campaigns that spread other macOS stealers.
The malware’s core function is credential and data theft. High-confidence reporting identifies Atomic Stealer as capable of harvesting browser data and session cookies, enabling follow-on account compromise and session hijacking. It is also used in campaigns targeting cryptocurrency-related assets and wallet information. Atomic Stealer is widely treated as a malware-as-a-service offering in the macOS crimeware landscape and has been linked in public reporting to Russian-speaking cybercriminal activity.
Atomic Stealer is notable as part of the broader shift toward more mature macOS crimeware, where operators increasingly rely on convincing social engineering, fake software distribution, and browser-data theft to monetize access. Its repeated appearance in campaigns abusing trusted brands, developer ecosystems, and user self-execution workflows has made it one of the most recognizable macOS infostealer families.
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
"...distribute... information stealers, such as Atomic (AMOS), Lumma, Rhadamanthys... and Vidar..."
13 distinct techniques documented for this family, organized by ATT&CK tactic.
Some adversaries have used lures designed specifically for macOS users that encourage the user to open Spotlight, then macOS Terminal to execute malicious commands.
In most scenarios, once users interact with the Fix or Verify button in the lure, the button will covertly copy an obfuscated PowerShell command to the clipboard and present the user with “verification steps.”
The adversary is trying to entice the user into verifying or fixing something by typing a command into a terminal, run dialog box, or PowerShell.
The viral popularity of OpenClaw has also led threat actors to capitalize on the phenomenon to distribute malicious GitHub repositories posing as OpenClaw installers to deploy information stealers like Atomic and Vidar Stealer, and a Golang-based proxy malware known as GhostSocks using ClickFix-style instructions.
These stealer malware families – of which there are many, such as Atomic, Lumma, and Vidar Stealer – come with capabilities to harvest a wide range of information from compromised systems, including cookies. | Session theft involves the covert exfiltration of session cookies from the web browser, either by gathering existing ones or waiting for a victim to log in to an account, to an attacker-controlled server.
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
Other indicator types observed in public reporting.
24 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Previously seen macOS infostealer referenced because the same distribution template was used to spread it.
Referenced as another macOS infostealer with overlapping objectives for comparison to AmnesiaStealer.
Mentioned as a comparable malware family with overlapping objectives to AmnesiaStealer.
Mentioned as another Mac malware family previously spread via the same ClickFix-style social-engineering technique.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.