Atomic Stealer Targets macOS Users Through Malicious Terminal Commands
A new malware campaign is distributing the Atomic MacOS (AMOS) stealer by tricking users into pasting malicious commands into their Terminal, leading to the theft of credentials and cryptocurrency.
A novel distribution method for the Atomic MacOS (AMOS) stealer has been identified, leveraging a deceptive website to lure unsuspecting users into executing malicious commands directly within their macOS Terminal application. The campaign, observed by researchers, uses a site named getmacouscloud[.]com, which presents itself as a source for "macOS toolkit" utilities. However, the provided text, when pasted into the Terminal, is actually a series of commands designed to download and install the AMOS stealer.
The infection chain begins with users visiting a compromised website, such as macostruecloud[.]xyz or getmacouscloud[.]com. These sites then prompt the user to copy and paste a block of text into their Terminal. This text, upon execution, fetches a script from a domain like render65[.]com. The script itself is often obfuscated, initially appearing as a zsh script, but it ultimately leads to the retrieval and installation of the AMOS stealer.
Once installed, the AMOS stealer actively seeks to exfiltrate sensitive information from the victim's macOS system. Its primary targets include stored credentials, browser data such as cookies and saved passwords, and cryptocurrency wallet information. The malware establishes persistence on the infected host, often placing its components in directories like /tmp or within the user's Application Support folder, to ensure continued operation and data theft.
Communication between the infected macOS machine and the attacker's command-and-control (C2) infrastructure is conducted over HTTP POST and GET requests, typically on TCP port 80. The C2 servers, identified by IP addresses like 188.166.78[.]138, receive staged data from the stealer, including information about the compromised device, session initiation, and details about the types of data being exfiltrated, such as messengers, credentials, browsers, and wallets.
Analysis of the malware reveals multiple components, including Mach-O universal binaries designed to run on both Intel (x86_64) and Apple Silicon (arm64) architectures. The initial payload is a relatively small script, but it acts as a downloader for the more substantial stealer components. The persistence mechanisms observed suggest an effort to maintain a foothold on the system for ongoing data collection and exfiltration.
Indicators of compromise associated with this campaign include specific URLs used for initial distribution and C2 communication, as well as SHA-256 hashes for the various malicious files involved in the infection chain. Researchers have provided a comprehensive list of these indicators to aid in detection and mitigation efforts.
This attack vector highlights a growing trend of social engineering tactics targeting macOS users. By exploiting the trust users place in their operating system's terminal and presenting a seemingly legitimate utility, attackers can bypass traditional security measures and deploy sophisticated information-stealing malware. The use of obfuscated scripts and multi-stage downloads further complicates detection and analysis.