Atomic macOS (AMOS) Stealer Evolves with Deceptive Installation Tactics
A new analysis details the Atomic macOS (AMOS) stealer, a growing threat that tricks users into granting permissions via deceptive setup guides to steal credentials and sensitive data.
The Atomic macOS (AMOS) stealer is an emerging information-stealing malware targeting Apple's operating system, posing a significant threat to users. Advertised on platforms like Telegram since April 2024, AMOS stealer has become a noticeable component of the macOS malware landscape. Its primary function is to exfiltrate sensitive data, including system information, login credentials for various applications, and cryptocurrency wallet details.
The malware's distribution methods are varied and rely heavily on social engineering. Researchers have observed AMOS stealer being spread through "ClickFix" campaigns, which typically involve deceptive CAPTCHA or verification pages that inject malicious scripts into a user's clipboard. Users are then instructed to paste these scripts into their system's Terminal, inadvertently executing the malware. Additionally, AMOS stealer has been distributed via malicious advertisements and fake websites offering cracked software or essential tools, such as a "macOS toolkit," which ultimately install the stealer.
A recent analysis focused on an AMOS stealer infection originating from a website, getmacouscloud[.]com, that purported to offer a "macOS toolkit." Following the provided instructions, a malicious Z-shell script was executed in the macOS Terminal. This script, retrieved from ferncore13[.]com, contained Base64-encoded, GZIP-compressed payload. Upon decompression, this payload revealed another Zsh script responsible for downloading and executing a Mach-O binary, which serves as the AMOS stealer installer.
The infection process involves the creation of specific files and directories designed to evade detection and persist on the system. The installer binary, saved as /tmp/helper, works in conjunction with a plist file named starter. This plist file configures the system to launch the AMOS stealer executable, named AccountsHelper, from a hidden directory within /Library/Application Support/.com.apple.accountsd/. A similar persistence mechanism is established in /Library/Application Support/.com.apple.metadata.mds/ using files named .mdworker and mdworker_shared.
A critical step in the infection chain requires user interaction, where the macOS host prompts for the user's administrative password to proceed. Once authenticated, the malware leverages the Terminal process to request a series of intrusive permissions. These include the ability to control the macOS Finder application, access files in the user's Desktop and Documents folders, and control the Notes application. These permissions are crucial for the stealer to effectively gather sensitive information.
Following the successful acquisition of permissions, AMOS stealer collects data and compresses it into an out.zip file, typically stored in the /tmp directory. The contents of this archive reveal the breadth of data the stealer targets, including credentials from cryptocurrency wallets like Binance and TonKeeper, files from applications such as FileZilla and Docker, browser data, and Zsh history. The stealer also searches for specific application data, indicating its broad scope of interest.
Post-infection, the AMOS stealer communicates with its command and control (C2) server, identified as 161.35.146[.]120, using HTTP POST requests. The URLs used in these requests provide insight into the stages of data exfiltration, including stage=boot, stage=init_session, stage=messengers, stage=credentials, stage=browsers, stage=wallets, stage=resolve_auth, and stage=local_data. This communication pattern helps in identifying and blocking the malware's C2 infrastructure.
The continuous evolution of AMOS stealer, particularly its sophisticated social engineering tactics and evasion techniques, underscores the need for vigilant security practices among macOS users. Staying informed about the latest distribution vectors and maintaining up-to-date security software are essential to mitigate the risks posed by this growing threat.