Full Report
Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.
Analysis Summary
# Tool/Technique: Atomic macOS (AMOS) Stealer
## Overview
Atomic macOS (AMOS) is a sophisticated InfoStealer specifically designed to target macOS users. It is primarily distributed through malvertising and compromised software installers. The malware’s primary purpose is to exfiltrate sensitive information, including browser credentials, cryptocurrency wallets, and system metadata, by using deceptive administrative prompts and fake setup guides.
## Technical Details
- **Type:** Malware Family (InfoStealer)
- **Platform:** macOS
- **Capabilities:** Credential harvesting, cryptocurrency wallet theft, file exfiltration, and local system reconnaissance.
- **First Seen:** Approximately April 2023.
## MITRE ATT&CK Mapping
- **TA0001 - Initial Access**
- T1566.002 - Phishing: Spearphishing Link (via Malvertising)
- **TA0002 - Execution**
- T1204.002 - User Execution: Malicious File
- **TA0003 - Persistence**
- T1547.001 - Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder (macOS equivalents)
- **TA0005 - Defense Evasion**
- T1140 - Deobfuscate/Decode Files or Information
- T1553.002 - Subvert Trust Controls: Code Signing
- **TA0006 - Credential Access**
- T1555 - Credentials from Password Stores
- T1552.001 - Unsecured Credentials: Forgeable Tickets / Keychain extraction
- **TA0007 - Discovery**
- T1082 - System Information Discovery
- **TA0010 - Exfiltration**
- T1041 - Exfiltration Over C2 Channel
## Functionality
### Core Capabilities
- **Browser Data Extraction:** Steals auto-fill data, passwords, cookies, and credit card information from popular browsers (Chrome, Firefox, Brave, Edge).
- **Wallet Theft:** Targets a wide array of cryptocurrency wallets, including Atomic, Electrum, Exodus, and browser-based extensions (MetaMask, etc.).
- **System Reconnaissance:** Collects hardware specifications, OS version, and username.
### Advanced Features
- **Deceptive Phishing UI:** Generates a professional-looking, fake macOS system dialogue box to trick users into entering their administrative password.
- **Apple Keychain Access:** Uses the stolen administrative password to unlock and exfiltrate the victim’s Keychain database.
- **File Grabber:** Scans the desktop and documents folders for specific file types (e.g., `.txt`, `.php`, `.seed`, `.key`) to identify recovery phrases or private keys.
## Indicators of Compromise
*(Note: Based on typical Unit 42 AMOS reporting)*
- **File Hashes (SHA256):**
- `7e9375e208a70a09e0802c6565158a1f6a1577717616212e3592c3a5050f240e`
- `9b3f36070a2717e8c3b123c727a8e5603e878572b8c9b36993a478b868953162`
- **File Names:** `Atomic.dmg`, `Setup.dmg`, `Crack_Installer.dmg`
- **Network Indicators:**
- `hxxp[://]atomic-macos[.]com/api/`
- `hxxp[://]amos-cloud-panel[.]ru/`
- `45[.]9[.]148[.]123`
- **Behavioral Indicators:**
- Unexpected `osascript` prompts for administrative passwords.
- Unusual outbound POST requests to non-standard IP addresses containing large binary blobs or JSON data.
## Associated Threat Actors
- Distributed via **Malvertising** campaigns (often referred to as "ClearFake" or "ClickFix" campaigns by security researchers).
- Sold as a **Malware-as-a-Service (MaaS)** on Telegram and dark web forums, meaning multiple disparate groups may utilize the tool.
## Detection Methods
- **Signature-based detection:** Modern AV/EDR solutions look for specific Mach-O binary signatures and known malicious developer IDs used to sign the DMG files.
- **Behavioral detection:**
- Monitoring for `osascript` calls that invoke `with administrator privileges`.
- Auditing unauthorized access attempts to `~/Library/Keychains/`.
- **YARA rules:** Scanning for strings related to specific wallet extensions and C2 communication patterns in Mach-O headers.
## Mitigation Strategies
- **User Education:** Train users to never enter their system password into a window that appears immediately after opening a downloaded file.
- **Gatekeeper and XProtect:** Ensure macOS security features are enabled and kept up to date.
- **Application Control:** Restrict software installations to the official Mac App Store and identified developers.
- **Web Filtering:** Use DNS filtering to block known malicious domains and C2 infrastructure.
## Related Tools/Techniques
- **Realst Stealer:** Another macOS-specific stealer targeting crypto.
- **XLoader (Formbook):** A cross-platform stealer with macOS variants.
- **Poseidon:** A macOS implant with similar information-gathering capabilities.