Beyond Cracked Apps: New macOS Malware Is Using the Terminal to Steal Data

Trend Micro Research has uncovered a campaign distributing Atomic macOS Stealer (AMOS), a malware family designed to exfiltrate sensitive data from Apple devices. Attackers disguise AMOS as cracked versions of legitimate software, redirecting users searching for pirated tools such as CleanMyMac to trojanised installers, with some victims prompted to paste malicious commands into the macOS Terminal.

According to Trend Micro, the Terminal-based delivery can bypass Gatekeeper, which normally blocks unsigned or unverified apps from running, and resembles fake CAPTCHA prompts in its execution flow.

The infection chain is multi-stage: an installer script downloads an AppleScript into /tmp, a LaunchDaemon (com.finder.helper.plist) maintains persistence by running a hidden agent in an infinite loop, and the malware then collects system details and user credentials before compressing them into /tmp/out[.]zip for exfiltration via curl POST requests to attacker-controlled domains such as sivvino[.]com and other hardcoded IPs.

AMOS is equipped with sandbox evasion checks to detect VMware, QEMU, or unknown chips before payload execution, and is capable of broad data theft including browser data, cryptocurrency wallets, keychain items, Apple Notes, Telegram chats, OpenVPN profiles, and various file types. Apple’s Gatekeeper blocked many .dmg-based AMOS attempts in testing, but the Terminal route proved more effective for infections.