MalwareUsed by 1 actorExploits 3 CVEs

Amos Stealer

AMOS Stealer, also known as Atomic Stealer or Atomic macOS Stealer, is a macOS information-stealing malware family that emerged in 2023. It is sold as malware-as-a-service through Telegram and underground forums and is maintained by a developer using the alias ping3r. Financially motivated operators use it against individuals and organizations, including users handling cryptocurrency and sensitive corporate or developer credentials.

AMOS collects saved browser passwords, cookies, autofill information, browsing history, macOS Keychain data, cryptocurrency wallet files and keys, Telegram session data, selected documents, and system information. It targets Chromium-based browsers and Firefox, among other applications. Fake system authentication dialogs solicit the victim's account password to facilitate credential access. Observed implementations execute encrypted or encoded AppleScript through native macOS utilities, archive collected information, and upload it to attacker-controlled infrastructure. Some implementations retry failed uploads and remove temporary collection artifacts afterward. Analyzed samples include universal Mach-O binaries supporting Intel and Apple silicon systems. Evasion behaviors include virtual-machine checks, concealed Terminal activity, payload obfuscation, and social engineering to bypass Gatekeeper protections. Persistence has been observed through macOS Login Items and launch agents.

Distribution includes phishing, deceptive software downloads, cracked applications, malicious advertisements, and fake-update campaigns such as ClearFake. ClickFix campaigns impersonate software installation guides or troubleshooting instructions and persuade victims to paste malicious commands into Terminal. Lures have impersonated Claude Code and macOS utilities, abused shared AI conversations, and redirected users through altered GitHub download links. Malicious OpenClaw skills distributed through ClawHub have also delivered AMOS.

For your environment

Hunt this family in your stack

Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.

Start free trial

EXPLOITED CVES

Vulnerabilities exploited

3 CVEs Mallory has correlated with this family across public research and vendor advisories. Each row links to the full Mallory page for that vulnerability.

3 CVES

CVE-2021-4436Unauthenticated arbitrary file upload in 3DPrint Lite for WordPressExploited in the wild

MITRE CONTEXT — Exploits Vulnerabilities: CVE-2021-4436; Threat Names: AMOS Stealer.

via intel471go.intel471.com

CVE-2025-0282Unauthenticated stack-based buffer overflow in Ivanti secure access appliancesExploited in the wild

MITRE CONTEXT — Exploits Vulnerabilities: CVE-2025-0282; Threat Names: AMOS Stealer.

via intel471go.intel471.com

CVE-2024-3400Unauthenticated root command execution in PAN-OS GlobalProtectExploited in the wild

MITRE CONTEXT — Exploits Vulnerabilities: CVE-2024-3400; Threat Names: AMOS Stealer.

via intel471go.intel471.com

THREAT ACTORS

Groups observed using it

1 distinct threat actor attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.

View more details

ShadowSyndicate

We found connections between ShadowSyndicate infrastructure and Amos Stealer infrastructure (moderate confidence)

via intrinsec blogintrinsec.com

MITRE ATT&CK

Techniques & procedures

35 distinct techniques documented for this family, organized by ATT&CK tactic.

Resource Development

1 technique

T1583Acquire InfrastructureEvidence1

Shown above: Malicious ad leading to page for AMOS Stealer.

Initial Access

2 techniques

T1078.003Local AccountsEvidence1

MITRE Technique Names: Local Account; MITRE Technique IDs: T1078.003

T1189Drive-by CompromiseEvidence1

ClearFake is a malicious JavaScript framework deployed on compromised websites to deliver malware through the drive-by download technique.

Execution

7 techniques

T1059Command and Scripting InterpreterEvidence1

Shown above: Text from the fake Brew page pasted into a terminal Window.

T1059.001PowerShellEvidence1

MITRE Technique Names: PowerShell; MITRE Technique IDs: T1059.001

T1059.002AppleScriptEvidence3

MITRE Technique Names: AppleScript; MITRE Technique IDs: T1059.002

T1059.004Unix ShellEvidence1

Once the script is downloaded, it automatically launches an AppleScript command using the zsh terminal shell to begin collecting data.

T1204User ExecutionEvidence1

The sidebar provided two follow-on options: ClickFix-style instructions and a download option, both intended to download and execute malicious code.

T1204.002Malicious FileEvidence1

This involved a Google Doc featuring a custom Google Apps Script sidebar designed to guide them through the execution of malware.

T1204.004Malicious Copy and PasteEvidence1

AMOS has been distributed through ClickFix campaigns, malicious advertisements, and websites offering cracked versions of popular software. These sites use fake installation instructions, such as a supposed macOS toolkit, to trick users into installing the malware.

Persistence

2 techniques

T1037.005Startup ItemsEvidence1

MITRE Technique Names: Startup Items; MITRE Technique IDs: T1037.005

T1078.003Local AccountsEvidence1

MITRE Technique Names: Local Account; MITRE Technique IDs: T1078.003

Privilege Escalation

2 techniques

T1037.005Startup ItemsEvidence1

MITRE Technique Names: Startup Items; MITRE Technique IDs: T1037.005

T1078.003Local AccountsEvidence1

MITRE Technique Names: Local Account; MITRE Technique IDs: T1078.003

Stealth

10 techniques

T1027Obfuscated Files or InformationEvidence2

MITRE Technique Names: Obfuscated Files or Information; MITRE Technique IDs: T1027

T1036MasqueradingEvidence4

MITRE Technique Names: Masquerading; MITRE Technique IDs: T1036

T1070.004File DeletionEvidence1

After a successful upload, Amos Stealer runs the cleanup commands ( rm -f /tmp/osalogging.zip and rm -rf /tmp/sync ) to erase its presence.

T1078.003Local AccountsEvidence1

MITRE Technique Names: Local Account; MITRE Technique IDs: T1078.003

T1497Virtualization/Sandbox EvasionEvidence1

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

T1497.001System ChecksEvidence1

MITRE Technique Names: System Checks; MITRE Technique IDs: T1497.001

T1564.003Hidden WindowEvidence1

Stealth and persistence Hides its execution by setting the Terminal window to invisible.

T1564.005Hidden File SystemEvidence1

MITRE Technique Names: Hidden File System; MITRE Technique IDs: T1564.005

T1622Debugger EvasionEvidence1

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

T1684.001ImpersonationEvidence1

in the latest campaign, the threat actors are distributing the infostealer through deceptive software downloads, fake websites, and social engineering lures.

Defense Impairment

2 techniques

T1222.002Linux and Mac PermissionsEvidence1

MITRE Technique Names: Linux and Mac File and Directory Permissions Modification; MITRE Technique IDs: T1222.002

T1647Plist File ModificationEvidence1

MITRE Technique Names: Plist File Modification; MITRE Technique IDs: T1647

Credential Access

4 techniques

T1056Input CaptureEvidence1

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

T1539Steal Web Session CookieEvidence1

It then collects stored passwords, session cookies, and autofill form information from Google Chrome and Microsoft Edge browsers.

T1555Credentials from Password StoresEvidence2

Password collection Attempts to retrieve the user’s Chrome master password via the security command.

T1555.003Credentials from Web BrowsersEvidence2

It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.

Discovery

7 techniques

T1082System Information DiscoveryEvidence3

MITRE Technique Names: System Information Discovery; gathers system profiling information, such as macOS version

T1087.001Local AccountEvidence1

MITRE Technique Names: Local Accounts; MITRE Technique IDs: T1087.001

T1120Peripheral Device DiscoveryEvidence1

MITRE Technique Names: Peripheral Device Discovery; MITRE Technique IDs: T1120

T1497Virtualization/Sandbox EvasionEvidence1

AMOS Stealer often employs anti-VM techniques to evade analysis in sandboxed environments, typically by querying system information to detect virtualization signatures like QEMU or VMware.

T1497.001System ChecksEvidence1

MITRE Technique Names: System Checks; MITRE Technique IDs: T1497.001

T1518Software DiscoveryEvidence1

MITRE Technique Names: Software Discovery; gathers system profiling information, such as macOS version, installed software, and network configurations

T1622Debugger EvasionEvidence1

initial breakpoints were set to catch key functions potentially used for anti-VM or anti-debugging checks: (lldb) breakpoint set --name ptrace

Collection

4 techniques

T1005Data from Local SystemEvidence3

It steals system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications.

T1056Input CaptureEvidence1

Prompts for the system password if needed, using a deceptive dialog disguised as a legitimate "System Preferences" request.

T1074.001Local Data StagingEvidence1

the malware uses a native macOS tool called ditto to compress the stolen files into a single archive named osalogging.zip inside the /tmp folder.

T1560Archive Collected DataEvidence2

Archives stolen data into a ZIP file ( /tmp/out.zip ) and uploads it to a hardcoded C2

Command and Control

1 technique

T1105Ingress Tool TransferEvidence2

Researchers noted that the malware operators use a built-in macOS utility called curl to download the malicious files silently.

Exfiltration

1 technique

T1041Exfiltration Over C2 ChannelEvidence2

uploads it to a hardcoded C2 (command-and-control) server ( hxxp[://]95[.]164[.]53[.]3/contact ) via a curl POST request.

INDICATORS OF COMPROMISE

IOCs tracked for this family

68 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.

View more in app

Network

34 tracked

IPs, domains, and DNS infrastructure linked to this family.

Hashes

15 tracked

File hashes (MD5, SHA-1, SHA-256) from samples and reports.

Other

19 tracked

Other indicator types observed in public reporting.

TypeValueLatest sighting

hash.md5●●●●●●●●●●●●View more in app5 days ago

domain●●●●●●●●●●●●View more in app12 days ago

uri●●●●●●●●●●●●View more in app18 days ago

domain●●●●●●●●●●●●View more in app23 days ago

hash.sha256●●●●●●●●●●●●View more in app23 days ago

ACTIVITY FEED

Recent activity

31 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

31 SOURCESView more in app

malware traffic analysis blogNews

Oct 5, 2026

Malware-Traffic-Analysis.net - 2026-10-02: Atomic macOS (AMOS) Stealer infection from malicious ad impersonating Claude Code

A macOS information stealer delivered through a malicious advertisement and website impersonating Claude Code. The documented infection uses ClickFix-style instructions to persuade the victim to paste a script into macOS Terminal. The malware subsequently displays password and permission requests.

malware traffic analysis blogNews

Oct 3, 2026

Malware-Traffic-Analysis.net - 2026-09-29: Macfinger ClickFix activity

A macOS stealer mentioned only for comparison. The author has not identified the malware delivered by the MacFinger ClickFix campaign and states that it does not appear to be AMOS Stealer. MacFinger is presented as a campaign name, not an identified malware family.

gurucul threat researchNews

Sep 17, 2026

Atomic macOS (AMOS) Stealer Activity | Community Portal | Gurucul

A macOS information stealer that collects system information, credentials, and sensitive data from web browsers, cryptocurrency wallets, and other applications. It has been distributed through ClickFix campaigns, malicious advertisements, and fake/cracked-software websites that use fraudulent installation instructions.

huntress blogNews

Aug 17, 2026

MacSync Stealer: How a Google Search for Claude Led to a macOS Infostealer | Huntress

A stealer referenced as part of prior AI-hosted ClickFix campaigns, not the main malware in this report.

+27 more in the timeline

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets match these IOCs, which detections are missing, which campaigns to expect next, and what to do in the next 30 minutes.

Start free trial

IOC matching68

Match every observed IP, domain, and hash against your live telemetry.

Threat actor attribution1

Named campaigns wielding this family, with evidence pinned to each claim.

Exploited vulnerabilities3

CVEs this family uses for access and lateral movement.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

MITRE ATT&CK mapping35

Every documented technique, ranked by evidence weight.

Researcher chatter

Reddit, Mastodon, and CTI community discussion around this family.

Amos Stealer