Atomic Stealer

ClickFix is a social engineering technique that displays fake CAPTCHAs, browser errors, or system alerts to trick visitors into copying and executing attacker-supplied "fix instructions."

domain slackcomtop.aab-e-pak.com Malvertising domain ... domain slackforbusiness.net Malvertising domain ... url_path slackforbusiness.net/api.php Malvertising domain ... domain macpaw.us Malvertising domain

Malvertising via Google Ads has also been noted privately among researchers as a distribution vector for Atomic Stealer.

Attackers are using the ClawHub skill marketplace to push harmful code into AI agent environments, stealing data and running financial fraud schemes that traditional security tools failed to catch.

These skills deployed infostealers, reverse shells and the Atomic macOS Stealer malware, exfiltrating browser credentials, keychains, SSH keys and crypto wallets.

...both being Go-based infostealers that also use osascript to display error messages to the user on execution...

After running the Terminal command, the attack downloads a malicious DMG from svs-verificationdate[.]beer using curl with the quiet " -fsSL " flags and saves it to the /tmp folder under a random filename.

the campaign begins with a fake CAPTCHA page that tells users to open Terminal and paste a malicious command to verify themselves.

OpenClaw is an AI agent that runs third-party skills sourced from ClawHub, a dedicated marketplace. These skills are markdown-driven packages with deep access to local systems. When a malicious skill is installed, it can seize full control of the agent’s identity and execute unauthorized actions through the agent’s own authenticated sessions.

A separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file, then padded it with 22 MB of junk characters to exceed file size limits that most scanning pipelines enforce.

Each of these skills mimicked a legitimate tool. The TradingView skills appeared to be trader productivity aids, and omnicogg passed for a general utility.

Variant C... has some rudimentary attempt at anti-analysis... queries the built-in system_profiler tool’s output for SPHardwareDataType, converts the output to lowercase, then searches it for the substring “vmware”. If the substring is found, the malware then exits.

A separate skill called omnicogg embedded the AMOS malware dropper inside a README.md file...

Defense Evasion - обход Gatekeeper (T1553.001, Gatekeeper Bypass).

Atomic does not attempt to gain persistence... Atomic Stealer uses a crude but effective means of extracting the user’s login password via AppleScript spoofing.

The TA also provides additional services such as a web panel for managing victims, meta mask brute-forcing for stealing seed and private keys...

It steals cookies, login databases, autofill information, stored payment cards, and browser profile data.

The campaign is infecting Mac devices with the Atomic macOS Stealer (AMOS) infostealer, which steals browser credentials, cryptocurrency wallet data, Keychain data, messaging app information, and user documents.

In addition to obtaining the system password, the malware also targets the password management tool by utilizing the main_keychain() function to extract sensitive information from the victim’s machine.

After collecting wallet details, the malware queries the installed browsers’ directories on the victim’s device and searches for particular browser-related files to extract confidential data, such as: Autofills Passwords Cookies Credit Cards.

Once decoded, it harvests... A raw copy of login.keychain-db

The stealer now steals the victim’s files from directories such as Desktop and Documents using the main_FileGrabber() function.

Variant C... has some rudimentary attempt at anti-analysis... queries the built-in system_profiler tool’s output for SPHardwareDataType, converts the output to lowercase, then searches it for the substring “vmware”. If the substring is found, the malware then exits.

The malware also steals Telegram Desktop and Discord data, Apple Notes databases, Safari cookies, Apple Keychain database files, and user documents with the PDF, TXT, or RTF extensions.

Atomic does not attempt to gain persistence... Atomic Stealer uses a crude but effective means of extracting the user’s login password via AppleScript spoofing.

All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it.

That command then pulled a macOS infostealer named cluw from a remote server at 2.26.75[.]16.

Finally, the Atomic macOS stealer processes the stolen information by compressing into ZIP and encoding it using Base64 format for exfiltration.

All harvested data is then stored in a ZIP archive and uploaded to the attacker's server, where the attacker can retrieve it.