CyberNew CyberNew
Ransomware & Malware Unit 42 1 month ago

Atomic macOS (AMOS) Stealer Activity

CN
CyberNew Threat Research Desk
• Original Reporting: Unit 42
CyberNew Threat Intel Assessment
Assessed Severity: CRITICAL
Impacted Surface
Client Endpoints & Operating Systems
Intelligence Sector
Ransomware & Malware

Analyst Takeaway

"Executive Summary This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer. Background AMOS stealer is..."

Recommended Defense & Mitigation

  • Emergency Patching: Prioritize vendor patches and CVE mitigation across internet-facing assets immediately.
  • Perimeter Audit: Inspect perimeter firewall logs and hunt for unauthorized RCE indicators.
Curated & Verified by CyberNew Threat Intelligence Desk Standard Defense Framework (NIST / MITRE ATT&CK)

Executive Summary

This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer.

Background

AMOS stealer is an information stealer targeting macOS systems that was advertised on Telegram as early as April 2024. AMOS stealer represents a noticeable portion of macOS stealer-based malware and is considered a growing threat. AMOS stealer exfiltrates system information, login credentials and other sensitive data from various applications, including web browsers and cryptocurrency wallets.

Malware that we've assessed as AMOS stealer has been distributed through ClickFix campaigns as well as through malicious ads. We've also seen AMOS stealer distributed through campaigns that claim to offer cracked versions of popular copyright-protected software. These sites offer instructions to install software such as a macOS toolkit but then actually install malware like AMOS stealer.

This article examines an AMOS stealer infection generated on Aug. 5, 2026, from an instructional page claiming to install a “macOS toolkit.”

Characteristics of the Infection

The domain hosting the malicious page claiming to have installation instructions for a macOS toolkit is getmacouscloud[.]com. An example of one of the pages is shown below in Figure 1.

Figure 1. A malicious website advertising a quick setup for “macOS toolkit.”

While the “quick setup” instructions from this page in Figure 1 are sometimes described as a ClickFix technique, this is not really ClickFix. The ClickFix technique generally uses a fake CAPTCHA or other type of verification page offering instructions to continue to the website a viewer intends to visit. ClickFix campaigns inject a script into a viewer's clipboard to paste into a Run window for Windows systems or a Terminal window for macOS systems.

Regardless of what we call this copy/paste technique, we followed the instructions in our lab environment. We copied text from the page and pasted it into a Terminal window on our macOS system as shown in Figure 2.

Figure 2. Malicious text pasted into a Terminal window.

The command in Figure 2 retrieved a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688. That Zsh script contains Base64-encoded text for a GZIP-compressed payload as shown in Figure 3.

Figure 3. Base64-encoded GZIP-compressed payload in the initial Zsh script.

That GZIP-compressed payload contains a follow-up Zsh script designed to retrieve and run a Mach-O binary to install AMOS stealer. That Mach-O binary for the AMOS stealer installer was saved as /tmp/helper, as shown below in Figure 4. The same directory also contained a plist file named starter, also shown in Figure 4.

Source Verification & Original Intelligence

This threat report was reviewed by CyberNew analysts and cross-referenced with primary security disclosures from Unit 42.

Primary Advisory →