Atomic macOS Stealer (AMOS)

Reported Context (30)

to the same operation that were found distributing a macOS stealer belonging to the Atomic Stealer (aka AMOS) family - Fake Web3 Accelerator Uses npm Packages to Deliver Malware and Hijack AI-Agent Traffic
Lowering the barrier to entry for novice and sophisticated threat actors alike, the Malware-as-a-Service (MaaS) model has accelerated the spread of specialized stealers like AMOS, MacSync, and Cthulhu. ICMacOS Infostealer Evolves Into a Persistent macOS RAT
The initial versions were implemented as AppleScripts and closely resembled the AMOS stealer family, but over time, MacSync developed distinctive features of its own, including a backdoor module. New MacSync macOS Stealer Uses Binary Loaders to Target Crypto Users and Developers
While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. AMOS Stealer Uses Fake macOS Toolkit Instructions to Target Credentials and Other Data
to a real Google Doc with a custom sidebar designed to trick the recipient into downloading malware: an AMOS infostealer on macOS, or PowerShell loader chain on Windows. Google Docs Sidebar Delivers Different Malware to Mac and Windows Users

CVE (7)

Malware (89)

People (72)

Threat Actors (19)

MITRE ATT&CK (76)

Vendors (49)

Products (193)

Tools (39)

Industries (21)

Countries (23)

Note: Related entities, including threat actors, malware, CVEs, MITRE ATT&CK techniques, vendors, products, tools, countries, and industries, are shown when they appear in the same reporting. Their presence does not necessarily mean they were targeted, compromised, vulnerable, responsible for the activity, or directly involved in the incident.