Executive Summary
Amos Stealer remains a prominent threat specifically engineered for macOS environments, primarily distributed through deceptive software downloads and social engineering. The malware focuses on financially motivated data theft, harvesting browser credentials, session cookies, and sensitive cryptocurrency wallet configurations.
Technically, the malware utilizes common macOS utilities like `curl` and `osascript` to facilitate initial payload delivery and data collection. It employs a modular execution flow, chunking stolen data into 10 MB segments for exfiltration to bypass network detection and using native tools like `ditto` for compression. The shift toward macOS targets demonstrates that these environments are increasingly part of the broader infostealer landscape.
This threat is particularly critical for organizations with significant macOS footprints or developer teams, as it specifically targets high-value artifacts like SSH keys, `.gitconfig` files, and the `login.keychain-db` database.