Executive Summary
Atomic Stealer (AMOS), a prominent macOS information stealer, has surfaced in a new 'malext' variant featuring enhanced evasion and persistence techniques. This version utilizes custom dynamic string decryption and AppleScript-based anti-VM checks to bypass analysis before executing its primary data-harvesting payload.
The malware systematically targets browser data, Apple Notes, and over 300 crypto-related extensions. Most notably, it now employs a sophisticated trojanization process for hardware wallet desktop apps like Ledger Live and Trezor Suite, replacing legitimate binaries with phishing interfaces that harvest seed phrases and passwords.
To ensure long-term access, AMOS implements a multi-stage persistence mechanism using a LaunchDaemon named 'com.finder.helper'. This daemon runs a persistent bash script (~/.agent) that monitors for active user sessions to relaunch a second-stage backdoor (~/.mainhelper), ensuring the malware remains active across reboots and user transitions.