macOS Under Attack: Atomic Stealer Hidden in Pirated Software

Atomic macOS Stealer (AMOS) is a data-theft malware identified by Trend Micro as Trojan.MacOS.Amos[.]PFH, targeting macOS users seeking cracked software. It spreads via two infection vectors: malicious DMG installers distributed as fake cracked applications, and a terminal command injection technique that prompts users to run commands in the macOS Terminal, bypassing Gatekeeper in part through social engineering.

On macOS Sequoia, unsigned DMG files are blocked with warnings such as “Apple could not verify the installer is free of malware.” AMOS uses living-off-the-land techniques, including legitimate utilities like osascript, curl and AppleScript, and employs domain rotation and anti-analysis checks to evade detection.

Once installed, the malware collects browser data (passwords, cookies, history), wallet files and private keys from desktop cryptocurrency apps, system information, personal files, and messaging data, then exfiltrates via ZIP archives to command-and-control servers using HTTP POST requests.

It also establishes persistence with a LaunchDaemon and hidden files, enabling automated execution at startup, with Trend Vision One’s Workbench generating alerts for credential access from web browsers and input capture via password prompts on macOS. According to Trend Micro.