Executive Summary
Atomic MacOS (AMOS) stealer remains a significant threat to macOS users, utilizing social engineering to bypass standard security warnings. Attackers leverage spoofed 'macOS toolkit' websites to trick users into copying and pasting base64-encoded strings directly into the macOS Terminal. This action initiates a multi-stage infection process that downloads persistent Mach-O binaries and zsh scripts.
Technically, the malware execution leads to the theft of sensitive data including browser credentials, cryptocurrency wallets, and messenger data. The infection creates persistence by nesting binaries within legitimate-looking hidden directories in the user's Application Support folder. Communication with C2 infrastructure occurs over standard HTTP port 80, using specific API endpoints to track the stage of the infection and exfiltrate harvested data.
This threat is particularly dangerous as it relies on user-initiated execution (T1204.001) to bypass Gatekeeper and other system protections. Organizations with significant macOS footprints should educate users on the risks of running unverified Terminal commands and monitor for the specific file paths and network behaviors associated with AMOS.