Incident · macOS infostealer

Atomic macOS Stealer: what it does on a Mac, and what Kilobat would have shown or blocked

Atomic macOS Stealer, or AMOS, is malware rented out to criminals, who spread it through fake download pages and search ads. Once someone runs it, it asks for their password, collects keychain items, browser data, crypto wallets and files, and posts them to a server, often by plain HTTP to a bare IP address.

When: Since April 2023Sources checked: 1 November 2026

In short

Protection: Limited
Blocks the lure sites, payload hosts and server addresses that are on the threat lists that day. Campaigns change hosts often, and new ones aren’t listed yet.
Ask about new apps: Limited
In Ask mode, an unsigned app or a binary in /tmp is held at its first connection, with its signer, path and destination. Apple’s own curl and osascript pass when Allow Apple Software is on.
App traffic: Would show
The app list would show the stealer’s process by path, uploading to a bare address over plain HTTP.
Agent guard: Wouldn’t help
AMOS campaigns target people, not agents. The agent guard applies only to what an AI agent starts.

What happened

Cyble found AMOS advertised on a Telegram channel in April 2023, at $1,000 a month with a web panel and a disk-image installer. SentinelOne noted that spreading it is left to whoever rents it, which is why the lures vary so much: fake installers, cracked software, sponsored search results. To read the keychain, it asks for the user’s password with an AppleScript dialog made to look like a system prompt.

Jamf Threat Labs described sponsored results for the Arc browser in 2024 leading to a lookalike site that served an ad-hoc signed disk image with instructions to right-click and open it, past Gatekeeper’s warning. In January 2025 a sponsored result for Homebrew showed the real address but led to brewe[.]sh, one letter off; Moonlock documented its install command, which fetched AMOS from another domain instead of Homebrew’s GitHub repository. Homebrew’s project leader said the ad was taken down within days and that such ads keep coming back.

Later campaigns skip the download. Unit 42 followed a fake “macOS toolkit” page in 2026 whose quick setup was a command to paste into Terminal; it fetched a script, which fetched a binary saved as /tmp/helper, asked for the password and collected wallets, Telegram data, browser data, zsh_history and the aws, gcloud and docker folders. Microsoft described AMOS in January 2026 arriving as a fake app download, installing a LaunchDaemon and polling its server for commands. Moonlock reported a campaign in March 2026 dressed as an AI agent tool, “Clearly AI”.

Timeline

April 2023
AMOS is sold on Telegram for $1,000 a month (Cyble, SentinelOne).
May 2023
SentinelOne documents a second variant and notes Google Ads as a distribution route.
April 2024
Jamf describes sponsored results for the Arc browser leading to fake download sites.
17–20 January 2025
A sponsored result for Homebrew leads to a lookalike site whose install command fetches AMOS (Moonlock).
January 2026
Microsoft observes AMOS delivered as a fake app, with a LaunchDaemon and a command loop.
March 2026
AMOS poses as an AI agent tool for the Mac (Moonlock, citing Intel 471 and CYFIRMA).
July–August 2026
Unit 42 runs two infections from a paste-into-Terminal page; the server address differs between them.

What it looked like on the network

The first connection is ordinary browsing: an ad click, then a lookalike page. For the paste-in variants, the next hop comes from Terminal: curl fetches a script from a second domain, often decoding it in memory (Microsoft describes curl … | base64 -d | gunzip), and the script fetches the binary. For the disk-image variants, the trojanized app connects out itself.

Collection is local and quiet. The data is staged under /tmp, zipped with macOS’s own ditto into out.zip, and sent with HTTP POSTs. Jamf saw a base64 zip in the request body; Microsoft saw POSTs to /log on a bare IP address, with headers naming the build and the user; Unit 42 saw a series of POSTs to a bare IP whose URLs end in stage=credentials, stage=browsers, stage=wallets and so on. Afterwards, the LaunchDaemon variant polls /api/v1/bot/actions/<id> for commands.

The processes involved are mostly macOS’s own, curl, osascript, ditto, run from Terminal or the fake app, plus the stealer’s binary. Unit 42 stresses that its domains, addresses and file names change often.

Indicators

As the sources document them. Domains are text, never links, and are defanged ([.]) where the source defangs them. Most of this infrastructure is long gone: indicators help you check old logs, files and accounts, not block today’s campaigns.

Indicator	Type	Where it shows	Note
`brewe[.]sh`	Domain	Browser	Lookalike Homebrew site behind a sponsored result, January 2025 (Moonlock).
`hxxps://norikosumiya[.]com/brew/update`	URL	Terminal (curl)	Where that site’s install command fetched AMOS (Moonlock).
`aricl[.]net, airci[.]net`	Domains	Browser	Fake Arc browser download sites, 2024 (Jamf).
`alliai[.]com, alli-ai[.]pro, ai[.]foqguzz[.]com, day[.]foqguzz[.]com`	Domains	Browser, the fake app	Redirects, the AlliAi.dmg download and its first connection, January 2026 (Microsoft).
`hxxp://217.119.139[.]117/log`	URL on a bare IP	Your Mac	Next-stage download (`/d/…`) and exfiltration, over plain HTTP (Microsoft).
`getmacouscloud[.]com, ferncore13[.]com, grove-89[.]com`	Domains	Browser, Terminal (curl)	The fake toolkit page, the host of the script and binary, and a third host Unit 42 lists, 2026.
`161.35.146[.]120, 188.166.78[.]138`	IP addresses	Your Mac	Server for the `stage=…` uploads on 5 August and 31 July 2026 (Unit 42).
`clearl[.]co`	Domain	Browser	Fake AI agent tool, Cleal_AI.dmg, March 2026 (Moonlock).
`/tmp/helper, /tmp/starter, /tmp/out.zip, /Library/LaunchDaemons/com.<random>.plist`	Files	Your Mac	The binary, a plist, the staged data, and the persistence of the January 2026 variant (Unit 42, Microsoft).

What Kilobat would have shown or blocked

Protection. Kilobat checks every app’s connections, the browser’s, Terminal’s and curl’s, against HaGeZi’s Threat Intelligence Feeds (domains and IP addresses), HaGeZi Fake and URLhaus, and refuses what they list, naming the app. A host or address that was listed on the day would have been blocked, page, payload or server. When we checked on 1 November 2026, none of the hosts and addresses in the table above were on those lists any more: lists drop infrastructure that has gone dark, and whether each one was listed while it was live can’t be checked now.
Ask about new apps. With Ask about new apps on, in the Travel or Work profile, the first connection of an app with no rule is held while Kilobat shows who signed it, its path and where it wants to go. An unsigned or ad-hoc signed app from a disk image, or a binary running from /tmp, would wait for your answer. With Allow Apple Software on, Apple’s curl and osascript are let through.
App traffic. Kilobat’s app list names command-line tools that aren’t part of macOS by their path, so /tmp/helper sending data stands out, with its upload and destination. A connection by bare address shows the address.

Where Kilobat wouldn’t have helped

Kilobat isn’t antivirus. It doesn’t stop you pasting a command, opening a disk image or typing your password into a fake dialog; keep XProtect and Gatekeeper on.
Most of the theft happens before any connection. Reading the keychain, browser profiles and wallets is local, and only the final upload touches the network.
Fresh lure sites and servers aren’t on any list yet. Moonlock found the fake AI tool’s site undetected by every engine on VirusTotal while it was live.
What was stolen is used from the attackers’ machines, with your cookies and passwords, so nothing more shows on your Mac.
The agent guard and agent network log don’t apply to programs you start yourself from Terminal or Finder.

Check your Mac now

Look for launch items you don’t recognise. AMOS has used com. followed by random letters.
```
ls -la /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents
```

Look for the hidden folders Unit 42 found, named to look like Apple’s. They don’t normally exist.

ls -la ~/Library/Application\ Support/.com.apple.accountsd ~/Library/Application\ Support/.com.apple.metadata.mds

Look for staged files. macOS clears /tmp on restart, so finding nothing proves little.
```
ls -la /tmp/helper /tmp/starter /tmp/out.zip
```
Look through your shell history for a command pasted from a web page that downloads and runs something.
```
grep -nE "curl .*\| *(ba|z)?sh|base64 -(d|D)" ~/.zsh_history
```
Install Homebrew only with the command on brew.sh, which fetches raw.githubusercontent.com/Homebrew/install/HEAD/install.sh. Before you run any install command, check the host it downloads from.
```
kilobat protect check example-download-host.com
```
Turn on Ask about new apps, with Apple software allowed, so new programs wait for you. See Get approvals for new apps.
```
kilobat settings new-apps ask
```
If you find signs of AMOS, assume your saved passwords, browser sessions, keychain and wallets are exposed. From another device, change passwords, sign out of other sessions and move crypto to a new wallet, then erase and reinstall macOS rather than trusting a cleanup.

Questions

Does Gatekeeper stop AMOS?

Not when people are talked past it. Jamf saw disk images that told users to right-click and open the app, and paste-into-Terminal variants never present an app to Gatekeeper at all. Keep it on anyway; it stops plenty.

Would Kilobat have blocked the fake Homebrew site?

Only if brewe[.]sh or the payload domain was on the threat lists while the ad ran, for about three days in January 2025. That can’t be checked after the fact, and it isn’t listed now.

Sources

Checked on 1 November 2026.

See what your agents and apps connect to

Kilobat is a Mac menu-bar app that names the app, process and agent behind every connection, keeps them away from known-bad hosts, and logs what each agent session reached.

Download for Mac ↓

$ brew install seifip/kilobat/kilobat