The Rising Tide of macOS Infostealers: A Deep Dive into the AMOS Threat Landscape

In the evolving theater of cyber warfare, the long-standing myth that macOS is immune to malware has been decisively dismantled. Sophos Managed Detection and Response (MDR) teams have recently documented a sophisticated campaign involving the Atomic macOS (AMOS) infostealer, highlighting a disturbing shift in how threat actors target Apple’s ecosystem. By leveraging psychological manipulation and low-barrier infection vectors, cybercriminals are turning the macOS terminal into a conduit for massive data exfiltration.

The Evolution of AMOS: A Persistent Threat

The Atomic macOS (AMOS) stealer is no longer an obscure tool; it has matured into a dominant force in the malware-as-a-service (MaaS) market. Accounting for nearly 40% of all macOS-related protection updates initiated by Sophos in 2025, AMOS represents a significant escalation in risk. Over the last three months alone, it has appeared in nearly half of all macOS stealer reports analyzed by security researchers.

First documented in April 2023, AMOS has undergone rapid iteration. Its primary objective is the wholesale extraction of high-value digital assets: Keychain passwords, browser credentials, autofill data, session cookies, and cryptocurrency wallet keys. This data enables attackers to execute rapid account takeovers, often resulting in permanent loss of financial assets and identity compromise.

The threat is global and platform-agnostic in its methodology, as evidenced by recent campaigns identified by industry peers. From the "SHAMOS" variant tracked by CrowdStrike in August 2025 to the exploitation of poisoned search results involving AI tools like ChatGPT and Grok reported by Huntress, the threat surface is expanding. Microsoft’s February 2026 findings further confirm that infostealers are increasingly abusing native macOS utilities to bypass traditional security gates.

The Mechanics of the Attack: A Chronology of Compromise

The incident investigated by Sophos follows a classic, albeit highly effective, "ClickFix" social engineering pattern. Rather than relying on complex zero-day exploit chains—which are increasingly difficult to maintain—the attackers rely on the "human vulnerability."

1. The Initial Lure (Bootstrapping)

The attack begins when a user, lured by a fake prompt or a deceptive website, is coerced into opening the macOS Terminal. The victim is tricked into copying and pasting a seemingly benign command. Under the hood, this command executes a base64-encoded bash script that fetches a payload from an attacker-controlled domain (e.g., sphereou[.]com). By masking the download process behind a legitimate system tool, the attacker bypasses initial browser-based warnings.

2. Password Harvesting

Once the initial script executes, the malware initiates a local validation process. It prompts the user for their macOS system password. Because the request appears within the context of a "fix" or an "update," users often comply, inadvertently handing over the keys to their machine. The malware verifies the password using the dscl (Directory Service command line) utility and stores the credentials in a hidden file for subsequent administrative tasks.

3. Payload Deployment and Anti-Analysis

With the password secured, the malware downloads a secondary, more potent payload. It uses the xattr -c command to strip extended attributes from the file—a common trick to remove the "quarantine" flag that macOS uses to prevent the execution of downloaded, unsigned code.

Before proceeding, the malware performs a series of environment checks. By querying the system_profiler and checking hardware UUIDs, the malware determines if it is running in a virtual machine or a sandbox. If it detects signs of a security research environment, it aborts, effectively hiding its true capabilities from automated analysis tools.

4. Data Harvesting and Exfiltration

The core of the AMOS operation is its data-mining routine. The malware creates temporary staging directories to organize stolen files. It targets specific configuration flags, such as CONFIG_STEAL_FINDER and CONFIG_STEAL_NOTES_API, ensuring that sensitive notes and file-system metadata are captured.

Particularly concerning is the inclusion of modules mimicking legitimate cryptocurrency applications like Ledger Wallet and Trezor Suite. These are designed to trick users into revealing private keys or seed phrases. Once the data is gathered, it is compressed into a zip archive and exfiltrated via an HTTP POST request to an attacker-controlled server.

5. Achieving Persistence

To ensure that the malware survives a system reboot, the threat actor installs a LaunchDaemon. By placing a hidden binary in the /Library/LaunchDaemons/ directory, the attacker guarantees that the malicious code executes with root-level privileges upon every system start, creating a permanent backdoor for ongoing command-and-control (C2) communication.

Supporting Data: MITRE ATT&CK Mapping

The precision of this attack is reflected in how it maps to established cybersecurity frameworks. The following table illustrates the tactical maturity of the AMOS campaign:

Attack Stage	Tactic	Technique
Initial Execution	Execution	T1059.004 (Unix Shell)
Credential Prompt	Credential Access	T1056 (Input Capture)
Environment Checks	Discovery	T1082 (System Information Discovery)
Credential Harvesting	Credential Access	T1555 (Credentials from Password Stores)
Persistence	Persistence	T1543.001 (Launch Agent)

Industry and Official Responses

The proliferation of AMOS has sparked a coordinated response from the cybersecurity industry. Sophos, alongside partners in the security research community, has been aggressive in identifying and tagging these variants.

Industry reports have shifted from treating these as "isolated incidents" to viewing them as part of a systemic "platform abuse" problem. When asked about the growing prevalence of these attacks, security analysts point to the "ClickFix" technique as a watershed moment in social engineering. By utilizing the terminal—a tool designed for advanced users—the attackers effectively turn the operating system’s own power against the user.

Furthermore, the integration of AI-themed lures—where attackers pose as providers of AI agents or tools—indicates that threat actors are highly attuned to the current technological zeitgeist. They are leveraging the public’s eagerness to adopt new AI tools to deliver malware, a trend that is unlikely to slow down in the near future.

Implications: The New Reality of macOS Security

The implications of this shift are profound for both enterprise IT departments and individual macOS users.

For the Enterprise

The "Mac-in-the-enterprise" model has grown significantly, but security infrastructure has not always kept pace. The AMOS threat proves that endpoint protection must move beyond simple signature-based detection. Organizations must implement:

• Zero-Trust Terminal Access: Restricting access to Terminal commands for non-technical employees.
• Managed Detection and Response (MDR): Employing 24/7 human-led hunting to detect anomalies that automated tools might miss.
• Behavioral Monitoring: Focusing on processes that strip extended attributes or attempt to read Keychain files unexpectedly.

For the Individual

The primary defense remains vigilance. The "ClickFix" method relies entirely on the victim being convinced to run a command. Users must internalize a fundamental rule: Never run terminal commands provided by a website, an email, or a suspicious prompt. If a legitimate application needs an update, it will always be delivered through the App Store or the application’s built-in, signed updater—never through a manual copy-paste command in the Terminal.

Conclusion: A Call to Vigilance

The AMOS stealer is a reminder that the threat landscape is not stagnant. As macOS gains market share and becomes a more attractive target, the complexity of attacks will only increase. Sophos remains committed to monitoring these developments, updating detection capabilities, and providing the transparency necessary to keep users safe.

The battle against infostealers is a game of cat and mouse, but it is one where the user is the final line of defense. By understanding the tactics of the adversary—how they lure, how they harvest, and how they hide—we can turn the tide against these malicious actors. For those looking to secure their systems further, the full list of Indicators of Compromise (IOCs) related to this investigation is available via the SophosLabs GitHub repository.

As we move forward, the focus must remain on proactive, layered security, ensuring that even if one door is opened by social engineering, the rest of the house remains secure.