A Sneaky macOS Malware Steals Data from Unwary Users
Cybersecurity researchers have discovered a new, highly sophisticated malware strain targeting Apple’s macOS operating system. Dubbed Atomic MacOS (AMOS) stealer, this malicious software has already infected several users who unsuspectingly downloaded and executed it by pasting a seemingly innocuous command into their Terminal window.
According to SANS ISC researcher Brad Duncan, the malware is spread through a web page hosted on getmacouscloud[.]com, which instructs victims to copy and paste a text string into their macOS Terminal. The malicious code then downloads and installs AMOS stealer, granting hackers access to sensitive data stored on the compromised machine.
Once installed, AMOS stealer begins transmitting stolen information back to its command and control (C2) servers over HTTP connections. Researchers have identified several C2 server IP addresses associated with the malware, including 188.166.78[.]138. The malicious code appears to be specifically designed to evade detection by security software, making it challenging for users to identify and remove.
Analysis of the malware’s behavior reveals a multi-stage infection process, with AMOS stealer extracting sensitive data from various locations on the compromised machine, including browser history, credentials, wallet information, and other sensitive files. The malware also establishes communication channels with its C2 servers, enabling hackers to remotely monitor and control the infected system.
Researchers note that users who have fallen victim to this malware may not even be aware they’ve been compromised, as AMOS stealer is designed to operate stealthily in the background. However, signs of infection can include unusual network activity or unexpected login attempts from unfamiliar locations.
To protect against similar attacks, cybersecurity experts recommend exercising extreme caution when interacting with online resources and downloading software. Always verify the authenticity of instructions and avoid executing commands that seem suspicious or out of place. Furthermore, ensure your macOS system is running the latest security patches and consider installing reputable antivirus software to detect and prevent malware infections.
As the threat landscape continues to evolve, users must remain vigilant and proactive in their online activities. By staying informed and adopting best practices for cybersecurity, individuals can significantly reduce their risk exposure to sophisticated threats like AMOS stealer.
Source: SANS ISC — 2026-08-02