Executive Summary
This article reviews an Atomic macOS (AMOS) stealer malware infection generated in a lab environment. While several sources have published articles analyzing AMOS stealer, the associated indicators constantly change. This article presents a snapshot of indicators seen in early August 2026 and is designed to help readers better understand AMOS stealer.
Background
AMOS stealer is an information stealer targeting macOS systems that was advertised on Telegram as early as April 2024. AMOS stealer represents a noticeable portion of macOS stealer-based malware and is considered a growing threat. AMOS stealer exfiltrates system information, login credentials and other sensitive data from various applications, including web browsers and cryptocurrency wallets.
Malware that we've assessed as AMOS stealer has been distributed through ClickFix campaigns as well as through malicious ads. We've also seen AMOS stealer distributed through campaigns that claim to offer cracked versions of popular copyright-protected software. These sites offer instructions to install software such as a macOS toolkit but then actually install malware like AMOS stealer.
This article examines an AMOS stealer infection generated on Aug. 5, 2026, from an instructional page claiming to install a “macOS toolkit.”
Characteristics of the Infection
The domain hosting the malicious page claiming to have installation instructions for a macOS toolkit is getmacouscloud[.]com. An example of one of the pages is shown below in Figure 1.
While the “quick setup” instructions from this page in Figure 1 are sometimes described as a ClickFix technique, this is not really ClickFix. The ClickFix technique generally uses a fake CAPTCHA or other type of verification page offering instructions to continue to the website a viewer intends to visit. ClickFix campaigns inject a script into a viewer's clipboard to paste into a Run window for Windows systems or a Terminal window for macOS systems.
Regardless of what we call this copy/paste technique, we followed the instructions in our lab environment. We copied text from the page and pasted it into a Terminal window on our macOS system as shown in Figure 2.
The command in Figure 2 retrieved a Z-shell (Zsh) script from hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688. That Zsh script contains Base64-encoded text for a GZIP-compressed payload as shown in Figure 3.
That GZIP-compressed payload contains a follow-up Zsh script designed to retrieve and run a Mach-O binary to install AMOS stealer. That Mach-O binary for the AMOS stealer installer was saved as /tmp/helper, as shown below in Figure 4. The same directory also contained a plist file named starter, also shown in Figure 4.
The plist file at /tmp/starter contains text that hints at a newly created file in the user's /Library/Application Support/.com.apple.accountsd/ directory named .service. This file is a shell script that runs a Mach-O file for AMOS stealer in the same directory named AccountsHelper, as shown in Figure 5.
We found an additional directory and similar files in the user's /Library/Application Support/.com.apple.metadata.mds/ directory named .mdworker and mdworker_shared., as shown below in Figure 6. The .mdworker file is a shell script that runs another AMOS stealer Mach-O file named mdworker_shared.
Of note, before the infection would proceed, the macOS host presented a prompt to enter the user's password as shown below in Figure 7. Since the user account on this macOS host was an administrative account, it proceeded when we entered the user's password.
After entering the user's password, the host's Terminal process presented prompts requesting various permissions during the infection, as noted below in Figure 8.
After running the initial malicious text in the Terminal window, the Terminal process requested the following permissions:
- Access to control the macOS Finder application
- Access to files in the user's Desktop folder
- Access to files in the user's Documents folder
- Access to control the macOS Notes application
AMOS stealer collected and temporarily saved information under the host's /tmp directory, and compressed the data into a file named out.zip. The file and directory structure of the out.zip file follows:
- Directory: deskwallets/Binance/
- Directory: deskwallets/TonKeeper/
- Directory: FileGrabber/aws/
- Directory: FileGrabber/docker/
- Directory: FileGrabber/filezilla/
- Directory: FileGrabber/gcloud/
- File: FileGrabber/zsh_history
- File: info
- Directory: Telegram Data/
- File: username
The infected macOS host was a clean installation with no additional added applications. However, the file and directory content of out.zip hints at the applications that AMOS stealer searched for during this infection.
Infection Traffic
Post-infection traffic consisted mainly of HTTP POST requests to a command and control (C2) server at 161.35.146[.]120. Figure 9 shows traffic from the infection filtered in Wireshark.
As shown above in Figure 9, URLs for the initial HTTP POST requests hint at the types of data collected by AMOS stealer. These initial URLs end with the following strings:
- stage=boot
- stage=init_session
- stage=messengers
- stage=credentials
- stage=browsers
- stage=wallets
- stage=resolve_auth
- stage=local_data
Comparing this AMOS stealer infection on Aug. 5, 2026, with a previous infection on July 31, 2026, reveals similar post-infection URL patterns. However, that AMOS stealer infection generated traffic to a different C2 server at 188.166.78[.]138.
This comparison underscores a notable characteristic of AMOS stealer and its supporting infrastructure. The associated domains, URLs and IP addresses frequently change for AMOS stealer activity. The same frequent changes apply to filenames, file hashes and directory paths seen in our post-infection forensic analysis.
These different AMOS stealer characteristics over a relatively brief period indicate this is a malware family in active development, which is continually evolving.
Conclusion
This article reviewed an Atomic stealer malware infection from early August 2026. The resulting analysis includes behavior from the infected macOS host, malware samples, post-infection artifacts and traffic patterns that indicate the types of information collected by this malware.
The key to understanding AMOS stealer is realizing this malware is continually evolving. The indicators frequently change, and the ones we present in this research are no longer the most current. However, the overall patterns of activity remain consistent. While this review is a snapshot, analysts and other security professionals can better understand AMOS stealer by keeping track of its changes in the coming weeks and months.
Palo Alto Networks Product Protections
Palo Alto Networks customers are better protected from AMOS stealer and related threats through the following products and services:
- Advanced URL Filtering and Advanced DNS Security identify known domains and URLs associated with this activity as malicious.
If you think you may have been compromised or have an urgent matter, get in touch with the Unit 42 Incident Response team or call:
- North America: Toll Free: +1 (866) 486-4842 (866.4.UNIT42)
- UK: +44.20.3743.3660
- Europe and Middle East: +31.20.299.3130
- Asia: +65.6983.8730
- Japan: +81.50.1790.0200
- Australia: +61.2.4062.7950
- India: 000 800 050 45107
- South Korea: +82.080.467.8774
Palo Alto Networks has shared these findings with our fellow Cyber Threat Alliance (CTA) members. CTA members use this intelligence to rapidly deploy protections to their customers and to systematically disrupt malicious cyber actors. Learn more about the Cyber Threat Alliance.
Indicators of Compromise
We discovered the following five files during this AMOS stealer infection:
Initial Zsh script downloaded from a command run from the macOS Terminal window
- SHA-256 hash: 71781ad8adefb499aee9bcbe1a166e69ccc37a47066682f617d65c76d8cde88c
- File size: 1,991 bytes
- File type: Zsh script text executable, ASCII text
- File location: hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688
Payload (Zsh script) extracted from the initially downloaded Zsh script
- SHA-256 hash: 7ea6ff8b12c59aaae1ab6f4f5a57045dad5a8127954f3ffd3d1c154d40d7ca3a
- File size: 1,213 bytes
- File type: Zsh script text executable, ASCII text, ASCII text, with very long lines (323)
Installer for AMOS stealer
- SHA-256 hash: a598fcdcd49247312861ff90c16cb4a5d49fede6072e30e7416dd276668fa2a9
- File size: 330,768 bytes
- File location: /tmp/helper
- File type: Mach-O universal binary with two architectures: x86_64 and ARM64
Binary from AMOS stealer infection persistent on the infected macOS host
- SHA-256 hash: 6bfcdb4920383375b7e519918df7eb4db751b974b5571a15ce66b82478012620
- File size: 438,576 bytes
- File location: /Users/[username]/Library/Application Support/.com.apple.accountsd/AccountsHelper
- File type: Mach-O universal binary with two architectures: x86_64 and ARM64
Another binary from AMOS stealer infection persistent on the infected macOS host
- SHA-256 hash: 4504006d1911057be42435d4625f03d83c4d0b7b6898d14beb9cdeba6cf667b9
- File size: 568,368 bytes
- File location: /Users/[username]/Library/Application Support/.com.apple.metadata.mds/mdworker_shared
- File type: Mach-O universal binary with two architectures: x86_64 and ARM64
Malicious website with instructions that will infect a vulnerable macOS host:
- hxxps[:]//getmacouscloud[.]com
URL for the initial download decoded from Base64 text provided by the malicious website:
- hxxps[:]//ferncore13[.]com/curl/608e70d1338612686917ee5cd300ff7ed8e318dfd787a50257f92142e99bd688
URLs from extracted from the payload returned from the initial download:
- hxxps[:]//grove-89[.]com/api/metrics/run?event=pasted
- hxxps[:]//ferncore13[.]com/2kqYRM0DCrnyJgoS4gVLl_FHJRRdTUhGCbjyuYwpZ6c/m1/update
Additional Resources
- 2026-06-09: Atomic macOS (AMOS) Stealer infection – Malware-Traffic-Analysis.net
- AMOS (Malware Family) – Malpedia
- Atomic MacOS (AMOS) stealer infection – SANS Technology Institute, Internet Storm Center
- Inside Amos Stealer: How This Threat Targets macOS Credentials and Keychains – CyberProof
- Threat Actor Selling New Atomic macOS (AMOS) Stealer on Telegram – Cyble
- Why AMOS matters: The macOS malware stealing data at scale – Sopho