Atomic macOS (AMOS) Stealer Activity

This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment by Palo Alto Unit 42. The AMOS stealer, advertised on Telegram as early as April 2024, represents a notable portion of macOS stealer-based malware and is considered a growing threat. AMOS stealer exfiltrates system information, login credentials and other sensitive data from various applications, including web browsers and cryptocurrency wallets.

Malware that we've assessed as AMOS stealer has been distributed through ClickFix campaigns as well as through malicious ads. We've also seen AMOS stealer distributed through campaigns that claim to offer cracked versions of popular copyright-protected software. These sites offer instructions to install software such as a macOS toolkit but then actually install malware like AMOS stealer.

This article examines an AMOS stealer infection generated on Aug. 5, 2026, from an instructional page claiming to install a “macOS toolkit.” The domain hosting the malicious page claiming to have installation instructions for a macOS toolkit is getmacouscloud[.]com. An example of one of the pages is shown below in Figure 1.

While the “quick setup” instructions from this page in Figure 1 are sometimes described as a ClickFix technique, this is not really ClickFix. The ClickFix technique generally uses a fake CAPTCHA or other type of verification page offering instructions to continue to the website a viewer intends to visit. ClickFix campaigns inject a script into a viewer's clipboard to paste into a Run window for Windows systems or a Terminal window for macOS systems.

Regardless of what we call this copy/paste technique, we followed the instructions in our lab environment. We copied text from the page and pasted it into a Terminal window on our macOS system as shown in Figure 2. The command in Figure 2 retrieved a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688. That Zsh script contains Base64-encoded text for a GZIP-compressed payload as shown in Figure 3.

That GZIP-compressed payload contains a follow-up Zsh script designed to retrieve and run a Mach-O binary to install AMOS stealer. That Mach-O binary for the AMOS stealer installer was saved as /tmp/helper, as shown below in Figure 4. The same directory also contained a plist file named starter, also shown in Figure 4.

The plist file at /tmp/starter contains text that hints at a newly created file in the user's /Library/Application Support/.com.apple.accountsd/ directory named .service. This file is a shell script that runs a Mach-O file for AMOS stealer in the same directory named AccountsHelper, as shown in Figure 5.

We found an additional directory and similar files in the user's /Library/Application Support/.com.apple.metadata.mds/ directory named .mdworker and mdworker_shared., as shown below in Figure 6. The .mdworker file is a shell script that runs another AMOS stealer Mach-O file named mdworker_shared.

Of note, before the infection would proceed, the macOS host presented a prompt to enter the user's password as shown below in Figure 7. Since the user account on this macOS host was an administrative account, it proceeded when we entered the user's password.

After entering the user's password, the host's Terminal process presented prompts requesting various permissions during the infection, as noted below in Figure 8.

After running the initial malicious text in the Terminal window, the Terminal process requested the following permissions:

• Access to control the macOS Finder application
• Access to files in the user's Desktop folder
• Access to files in the user's Documents folder
• Access to control the macOS Notes application

AMOS stealer collected and temporarily saved information under the host's /tmp directory, and compressed the data into a file named out.zip. The file and directory structure of the out.zip file follows:

• Directory: deskwallets/Binance/
• Directory: deskwallets/TonKeeper/
• Directory: FileGrabber/aws/
• Directory: FileGrabber/docker/
• Directory: FileGrabber/filezilla/
• Directory: FileGrabber/gcloud/
• File: FileGrabber/zsh_history
• File: info
• Directory: Telegram Data/
• File: username

The infected macOS host was a clean installation with no additional added applications. However, the file and directory content of out.zip hints at the applications that AMOS stealer searched for during this infection.

Post-infection traffic consisted mainly of HTTP POST requests to a command and control (C2) server at 161.35.146[.]120. Figure 9 shows traffic from the infection filtered in Wireshark.

As shown above in Figure 9, URLs for the initial HTTP POST requests hint at the types of data collected by AMOS stealer. These initial URLs end with the following strings:

• stage=boot
• stage=init_session
• stage=messengers
• stage=credentials
• stage=browsers
• stage=wallets
• stage=resolve_auth
• stage=local_data

Comparing this AMOS stealer infection on Aug. 5, 2026, with a previous infection on July 31, 2026, reveals similar post-infection URL patterns. However, that AMOS stealer infection generated traffic to a different C2 server at 188.166.78[.]138.

This comparison underscores a notable characteristic of AMOS stealer and its supporting infrastructure. The associated domains, URLs and IP addresses frequently change for AMOS stealer activity. The same frequent changes apply to filenames, file hashes and directory paths seen in our post-infection forensic analysis. These different AMOS stealer characteristics over a relatively brief period indicate this is a malware family in active development, which is continually evolving.

This article reviewed an Atomic stealer malware infection from early August 2026. The resulting analysis includes behavior from the infected macOS host, malware samples, post-infection artifacts and traffic patterns that indicate the types of information collected by this malware. The key to understanding AMOS stealer is realizing this malware is continually evolving. The indicators frequently change, and the ones we present in this research are no longer the most current. However, the overall patterns of activity remain consistent. While this review is a snapshot, analysts and other security professionals can better understand AMOS stealer by keeping track of its changes in the coming weeks and months.