Executive Summary
Atomic macOS (AMOS) is an evolving information stealer targeting the macOS platform, primarily distributed through 'ClickFix' style social engineering and malicious advertisements. Attackers lure users to fraudulent sites like getmacouscloud[.]com, where they are instructed to copy and paste malicious commands into their Terminal. This execution chain bypasses traditional download restrictions by leveraging user-initiated actions to download and install persistent Mach-O binaries.
Technically, the malware uses multi-stage Zsh scripts to fetch compressed payloads and Mach-O installers. Once active, it creates hidden directories within the user's Library folder to maintain persistence and captures local passwords via spoofed system prompts. The stealer targets sensitive information including browser credentials, messaging data (Telegram), and various cryptocurrency wallets (Binance, TonKeeper).
The rapid evolution of AMOS infrastructure—frequently changing C2 IPs, domains, and file hashes—makes it a persistent threat to organizational macOS fleets. Its focus on cryptocurrency wallets and session data suggests it is a high-impact threat for financial services and technology-focused sectors.