AMOS Stealer Accessing Telegram and Discord App Data on macOS

Ibrahim Saud@tektrix

•updated Jun 24, 2026•3•0•3

Detects unauthorized processes attempting to read sensitive application data directories (specifically for Telegram and Discord) on macOS. This behavior is indicative of infostealer malware, such as AMOS (Atomic macOS Stealer), attempting to exfiltrate session tokens and account information.