AMOS
Aliases: Atomic macOS Stealer
- First seen
- 2023-04-15 00:00:00
- Malware type
- credential-stealer
- Family
- Malware family
- Last IoC activity
- 2026-07-22 04:04:50
- Profile updated
- 2026-07-07 13:12:10
Targeted industries: financial-services technology-and-telecommunications
Context
AMOS, also known as Atomic macOS Stealer, is a malware targeting macOS systems to steal sensitive data such as credentials and cryptocurrency wallets. It primarily focuses on extracting information critical to financial and technology sectors.
Detection coverage
- 2 YARA rules
Detection rules
- RUSSIANPANDA_AMOS_Stealer (yara-rule)
- RUSSIANPANDA_AMOS_Stealer_1 (yara-rule)
Reports & references
- Kaspersky — 111483 (report)
- recordedfuture.com — The Travels Of Markopolo Self Proclaimed Meeting Software Vortax Spreads Infostealers (report)
- malpedia.caad.fkie.fraunhofer.de — Osx.Amos (report)
- malwarebytes.com — Atomic Macos Stealer Delivered Via Malvertising (report)
- kroll.com — New Amos Infection Vector Highlights Risks Around Ai Adoption (report)
- sentinelone.com — Atomic Stealer Threat Actor Spawns Second Variant Of Macos Malware Sold On Telegram (report)
- redcanary.com — Atomic Stealer (report)
- malwarebytes.com — Atomic Stealer Rings In The New Year With Updated Version (report)
- labs.k7computing.com — Mentalpositives New Macos Stealer Amos Repackaged Or A New Cyber Threat (report)
- huntress.com — Amos Stealer Chatgpt Grok Ai Trust (report)
- denwp.com — Amos Stealer Fud (report)
- bitdefender.com — When Stealers Converge New Variant Of Atomic Stealer In The Wild (report)
- hunt.io — Macos Odyssey Amos Malware Campaign (report)
- denshiyurei.medium.com — Silent Echoes The Hidden Dialogue Among Malware Entities Spotlight On Amos Infostealer 6D7Cd70E3219 (report)
- russianpanda.com — Atomic Stealer Amos (report)
- malwarebytes.com — Fake Malwarebytes Lastpass And Others On Github Serve Malware (report)
- intrinsec.com — Tlp Clear 31072025 Shadowsyndicate Infrastructure Illumination En (report)
- blog.cyble.com — Threat Actor Selling New Atomic Macos Amos Stealer On Telegram (report)
- spycloud.com — Reverse Engineering Atomic Macos Stealer (report)
- redcanary.com — Atomic Odyssey Poseidon Stealers (report)