A sophisticated macOS Stealer Malware has been discovered, targeting unsuspecting users through a convincing online decoy. The Atomic MacOS (AMOS) stealer infection is designed to siphon off sensitive information from compromised Macs, and its operators are using a cunning tactic to lure victims into installing the malware.
The AMOS stealer’s entry point lies in a website called getmacouscloud[.]com, which presents itself as a legitimate “macOS toolkit” to users. However, upon closer inspection, the site actually contains malicious code that instructs visitors to paste text into their Terminal window. This seemingly innocuous action downloads and installs the AMOS stealer malware onto the user’s machine.
In reality, this tactic allows the attackers to bypass traditional security measures, such as antivirus software and firewalls, which may not be able to detect the malicious code embedded in the Terminal command. The infection process is further complicated by the fact that the malware uses a base64-encoded payload, making it difficult for even experienced analysts to decipher its contents.
Once installed, the AMOS stealer begins to collect sensitive information from the compromised Mac, including user credentials, browser data, and credit card details. This stolen data is then transmitted back to the attackers’ command-and-control (C2) servers, where it can be sold or used for further malicious purposes.
The C2 traffic associated with the AMOS stealer infection is characterized by a series of HTTP POST requests over TCP port 80, which indicate that the malware is communicating with its operators in real-time. The attackers’ use of HTTPS encryption makes it challenging to intercept and analyze these communications, but researchers have managed to identify several key indicators of compromise (IOCs) that can help security professionals detect this threat.
For Mac users, it’s essential to remain vigilant when encountering online resources or websites claiming to offer “toolkits” or other software solutions. Always exercise caution when interacting with unfamiliar sites, and never paste text into your Terminal window without verifying its legitimacy first.
In the face of such sophisticated threats, it’s crucial for security professionals and everyday users alike to stay informed about emerging malware tactics and adopt robust defenses against these types of attacks. By doing so, we can minimize the impact of infections like AMOS stealer and protect our online assets from falling into the wrong hands.
Source: SANS ISC — 2026-08-02