AMOS Chrome Safe Storage credential theft from Chromium browser profile directories

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•4

Detects unauthorized processes accessing browser credential databases (e.g., Login Data, Cookies, Web Data) associated with Chromium-based browsers on macOS. This behavior is indicative of credential harvesting often performed by infostealers like AMOS (Atomic macOS Stealer).