Atomic Stealer, often abbreviated as AMOS, is a macOS infostealer malware family. It is designed to steal browser credentials, session cookies, cryptocurrency wallet data, and other saved secrets, then exfiltrate them to an attacker-controlled server. Security teams look for credential theft, persistence, and suspicious data collection on Apple endpoints.
What Atomic Stealer Is and Why It Matters
Atomic Stealer, also called AMOS, is macOS infostealer malware that targets browser credentials, session cookies, cryptocurrency wallet data, and other saved secrets for theft and exfiltration.
Its security significance is simple: once an infostealer reaches an endpoint, the attacker often gains reusable access material rather than just a one-time foothold. That can turn a single compromised Mac into access to email, SaaS, developer tools, cloud consoles, and financial accounts if the stolen material is accepted elsewhere.
How AMOS Steals Data and Maintains Access
AMOS is designed to collect high-value authentication and wallet material that users and browsers store locally. Browser cookies can be especially dangerous because they may represent already-authenticated sessions, so theft can bypass password prompts and some MFA flows until the session expires or is revoked.
Infostealers commonly rely on social engineering, malicious downloads, and fake software prompts to get execution on the endpoint. Once running, the malware may search for browser profiles, Keychain content, and other local secret stores, then package the results for exfiltration to an attacker-controlled server.
For broader macOS hunting patterns and response context, macOS Detection and Response Guide is the better operational companion because it covers the telemetry and persistence patterns defenders typically investigate after suspected infostealer activity.
How Organisations Check Exposure and Contain the Blast Radius
Exposure assessment starts with endpoint inventory, user role mapping, and a review of where high-value Mac systems are used, especially developer laptops and administrator workstations. Teams should also check whether the affected device had access to browser-stored sessions, password managers, cloud consoles, or cryptocurrency wallets that would make the theft materially more damaging.
Because stolen cookies and credentials can remain useful after the malware is removed, containment is not just an endpoint problem. Organisations usually need to revoke sessions, rotate exposed secrets, and review sign-in logs for suspicious reuse from unfamiliar locations or impossible travel patterns.
For the AMOS-specific delivery and detection context, Atomic macOS Stealer Guide explains the common lure patterns, theft targets, and response steps that help determine whether a Mac endpoint was actually impacted.
Detection, Recovery, and Post-Compromise Review
Detection usually depends on combining endpoint telemetry, browser artifact review, and authentication logs. Useful indicators include unusual archive or upload activity, unexpected browser profile access, new persistence entries, and fresh logins that follow a suspicious macOS infection path.
Recovery should assume that anything the infostealer could read may be compromised. That means reviewing credential stores, rotating affected passwords and API keys, invalidating active sessions where possible, and checking whether any secondary systems were accessed using the stolen material.
Where teams need endpoint-focused triage for persistence and infostealer activity, the macOS Detection and Response Guide provides the most relevant investigation and response framing for Apple environments.
Risk and Threat Considerations
AMOS is dangerous because it targets the kinds of secrets that unlock other systems, not just the endpoint itself. Theft of cookies, passwords, and wallet data can lead to account takeover, session hijacking, financial loss, and lateral access to cloud or developer environments.
Failure mechanism: The malware converts a local compromise into broader access by harvesting reusable credentials and authenticated sessions, then exfiltrating them before defenders notice.
Impact: Organisations may face compromised email, SaaS, cloud, and wallet accounts, along with follow-on fraud, data exposure, and additional intrusion paths from trusted identities.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST CSF 2.0 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1005 — Data from Local System | AMOS steals locally stored browser and wallet data from the Mac. |
| T1555 — Credentials from Password Stores | AMOS targets saved secrets and browser-stored credentials on macOS. | |
| T1539 — Steal Web Session Cookie | AMOS can steal authenticated browser session cookies for reuse. | |
| Recommendation — Hunt for local data collection and exfiltration patterns after suspected AMOS activity. Review password stores and browser profiles for credential access indicative of infostealer compromise. Invalidate stolen sessions and investigate cookie-based account reuse after compromise. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Anomalies and Events | AMOS detection depends on observing abnormal endpoint and authentication activity. |
| RS.MA-01 — Incident Mitigation | AMOS response requires containment, revocation, and cleanup after compromise. | |
| Recommendation — Monitor Macs and sign-in telemetry for anomalous data collection and follow-on account access. Contain infected endpoints and revoke exposed access paths during incident handling. | ||
Practitioner Guidance
What to watch for: Treat AMOS as an identity and session compromise event as much as an endpoint malware event. The most important response decision is often not cleanup, but which credentials, sessions, and stored secrets must be revoked or rotated immediately.
Practitioner takeaway: If a Mac is suspected of AMOS infection, assume the attacker has already benefited from whatever the user and browser had cached locally, and verify downstream account exposure before declaring recovery complete.