Atomic macOS Stealer (AMOS) Targets Credentials via Malicious Terminal Commands

The Atomic macOS Stealer (AMOS) is a malware targeting macOS systems, distributed through malicious websites instructing users to paste commands into Terminal. The malware steals sensitive information such as browser credentials, messenger data, and cryptocurrency wallets. An investigation revealed that the infection was generated in a lab on July 31, 2026, and involved repeated command executions leading to persistent Mach-O binaries in various directories. Network analysis showed communication with a command and control (C2) server through HTTP POST and GET requests. Users are advised against executing untrusted commands and organizations should monitor for suspicious activities. Immediate isolation of infected devices is recommended to prevent data exfiltration, along with resetting passwords for affected accounts. The incident highlights the need for better user education regarding command execution in macOS.

Key Points: • AMOS malware targets macOS users by exploiting Terminal command execution. • Sensitive information, including browser credentials and cryptocurrency wallets, is at risk. • Organizations should implement monitoring for suspicious command-line activities.