Atomic macOS (AMOS) Stealer Known Hash and Domain/URL IOC Hunt

Arnold Chan@slaz

•updated Sep 17, 2026•2•0•7

This rule detects activities associated with the AMOS (Atomic macOS Stealer) malware family by monitoring for known malicious file hashes on endpoints and network communication with domains linked to its command-and-control infrastructure.