Atomic Stealer: Darktrace’s Investigation of a Growing macOS Threat

Atomic Stealer, also known as AMOS, is now described by Darktrace as a rapidly growing macOS threat, capable of infostealing and backdoor access to target devices. According to Darktrace, infostealers have emerged as the largest category of new macOS malware, with a 101% increase in the last two quarters of 2024, and Atomic Stealer’s latest variant includes a backdoor for persistent access.

Since June 2025, Darktrace has observed Atomic Stealer activity across 24 countries, with early cases concentrated in the Europe, Middle East and Africa region before a broader global distribution, including education-sector victims. The campaign has used multiple distribution methods—fake installers, malvertising, and the ClickFix technique—while beaconing activity to external endpoints such as 45.94.47.x and related IPs linked to its command-and-control infrastructure.

In October, several devices showed beaconing to these endpoints, and in one case a file named out[.]zip was exfiltrated, underscoring the malware’s data-stealing capabilities.