Atomic macOS (AMOS) Stealer Activity

Atomic macOS (AMOS) is an information stealer targeting macOS users, actively evolving and distributed through malicious advertising and social engineering campaigns. Since at least April 2024, threat actors have utilized deceptive landing pages claiming to offer "macOS toolkits" or cracked software to lure victims. The infection chain relies on users manually copying and pasting malicious instructions into a Terminal window, which initiates a multi-stage process involving Zsh scripts, GZIP-compressed payloads, and the deployment of persistent Mach-O binaries. AMOS exfiltrates sensitive data including browser credentials, cryptocurrency wallet keys, and system metadata. The infrastructure, including C2 domains and IP addresses, is highly ephemeral and frequently changes, indicating active development and a strategy to evade static detection. Defenders must prioritize monitoring for anomalous Terminal activity and unauthorized modifications to macOS library directories.

Attack Chain

1. The victim visits a malicious website (e.g., getmacouscloud.com) advertising a fake "macOS toolkit" or software utility.
2. The site displays instructions tricking the user into copying and pasting a malicious command into the macOS Terminal.
3. The Terminal process executes the pasted command, which fetches a Zsh script from an attacker-controlled URL (e.g., ferncore13.com).
4. The downloaded Zsh script extracts and executes a Base64-encoded GZIP payload containing a secondary script and an AMOS installer binary.
5. The installer binary (/tmp/helper) is executed, often prompting the user for administrative credentials to escalate or proceed.
6. The malware establishes persistence by creating hidden files and shell scripts within the user's ~/Library/Application Support/ directory (e.g., .com.apple.accountsd/ or .com.apple.metadata.mds/).
7. The persistent Mach-O binaries (e.g., AccountsHelper, mdworker_shared) are executed to harvest data from browsers, wallets, and system files.
8. Collected data is compressed into out.zip and exfiltrated to the C2 server via HTTP POST requests, with stages categorized by data type (e.g., stage=browsers, stage=wallets).

Impact

Successful AMOS infection results in the theft of sensitive user data, including stored web browser credentials, cryptocurrency wallet seeds, and Telegram history. The malware's ability to request permissions to the macOS Finder, Desktop, Documents, and Notes applications provides broad access to a victim's personal and work-related files, potentially leading to unauthorized account takeovers and financial loss.

Recommendation

1. Deploy endpoint monitoring to detect Zsh script execution originating from shell commands containing base64-encoded strings.
2. Implement detection rules for processes creating or modifying files within the ~/Library/Application Support/ directory that share naming conventions with legitimate system services (e.g., .com.apple.accountsd).
3. Block the known malicious C2 infrastructure listed in the IOC table at the network perimeter.
4. Restrict the ability of standard users to execute arbitrary commands from external untrusted websites via Terminal.