--- title: "Atomic macOS Stealer: what it does on a Mac, and what Kilobat would have shown or blocked" url: "https://kilobat.app/incidents/atomic-macos-stealer" description: "How AMOS reaches Macs through fake ads, a fake Homebrew site and paste-into-Terminal pages, how it sends data to its servers, and what Kilobat can and can’t do." --- Incident · macOS infostealer # Atomic macOS Stealer: what it does on a Mac, and what Kilobat would have shown or blocked Atomic macOS Stealer, or AMOS, is malware rented out to criminals, who spread it through fake download pages and search ads. Once someone runs it, it asks for their password, collects keychain items, browser data, crypto wallets and files, and posts them to a server, often by plain HTTP to a bare IP address. When: Since April 2023 · Sources checked: 1 November 2026 ## In short - [Protection](https://kilobat.app/mac-malware-blocker): Limited Blocks the lure sites, payload hosts and server addresses that are on the threat lists that day. Campaigns change hosts often, and new ones aren’t listed yet. - [Ask about new apps](https://kilobat.app/guides/recipes/approve-new-apps): Limited In Ask mode, an unsigned app or a binary in `/tmp` is held at its first connection, with its signer, path and destination. Apple’s own curl and osascript pass when Allow Apple Software is on. - [App traffic](https://kilobat.app/mac-bandwidth-monitor): Would show The app list would show the stealer’s process by path, uploading to a bare address over plain HTTP. - [Agent guard](https://kilobat.app/mac-malware-blocker): Wouldn’t help AMOS campaigns target people, not agents. The agent guard applies only to what an AI agent starts. ## What happened [Cyble](https://cyble.com/blog/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/) found AMOS advertised on a Telegram channel in April 2023, at $1,000 a month with a web panel and a disk-image installer. [SentinelOne](https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/) noted that spreading it is left to whoever rents it, which is why the lures vary so much: fake installers, cracked software, sponsored search results. To read the keychain, it asks for the user’s password with an AppleScript dialog made to look like a system prompt. [Jamf Threat Labs](https://www.jamf.com/blog/infostealers-pose-threat-to-macos/) described sponsored results for the Arc browser in 2024 leading to a lookalike site that served an ad-hoc signed disk image with instructions to right-click and open it, past Gatekeeper’s warning. In January 2025 a sponsored result for Homebrew showed the real address but led to `brewe[.]sh`, one letter off; [Moonlock](https://moonlock.com/macos-malware-homebrew-ads) documented its install command, which fetched AMOS from another domain instead of Homebrew’s GitHub repository. Homebrew’s project leader said the ad was taken down within days and that such ads keep coming back. Later campaigns skip the download. [Unit 42](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) followed a fake “macOS toolkit” page in 2026 whose quick setup was a command to paste into Terminal; it fetched a script, which fetched a binary saved as `/tmp/helper`, asked for the password and collected wallets, Telegram data, browser data, `zsh_history` and the `aws`, `gcloud` and `docker` folders. [Microsoft](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/hunting-infostealers---macos-threats/4494435) described AMOS in January 2026 arriving as a fake app download, installing a LaunchDaemon and polling its server for commands. Moonlock reported a campaign in March 2026 dressed as an AI agent tool, “Clearly AI”. ## Timeline 1. April 2023 AMOS is sold on Telegram for $1,000 a month (Cyble, SentinelOne). 2. May 2023 SentinelOne documents a second variant and notes Google Ads as a distribution route. 3. April 2024 Jamf describes sponsored results for the Arc browser leading to fake download sites. 4. 17–20 January 2025 A sponsored result for Homebrew leads to a lookalike site whose install command fetches AMOS (Moonlock). 5. January 2026 Microsoft observes AMOS delivered as a fake app, with a LaunchDaemon and a command loop. 6. March 2026 AMOS poses as an AI agent tool for the Mac (Moonlock, citing Intel 471 and CYFIRMA). 7. July–August 2026 Unit 42 runs two infections from a paste-into-Terminal page; the server address differs between them. ## What it looked like on the network The first connection is ordinary browsing: an ad click, then a lookalike page. For the paste-in variants, the next hop comes from Terminal: `curl` fetches a script from a second domain, often decoding it in memory (Microsoft describes `curl … | base64 -d | gunzip`), and the script fetches the binary. For the disk-image variants, the trojanized app connects out itself. Collection is local and quiet. The data is staged under `/tmp`, zipped with macOS’s own `ditto` into `out.zip`, and sent with HTTP `POST`s. Jamf saw a base64 zip in the request body; Microsoft saw `POST`s to `/log` on a bare IP address, with headers naming the build and the user; Unit 42 saw a series of `POST`s to a bare IP whose URLs end in `stage=credentials`, `stage=browsers`, `stage=wallets` and so on. Afterwards, the LaunchDaemon variant polls `/api/v1/bot/actions/` for commands. The processes involved are mostly macOS’s own, `curl`, `osascript`, `ditto`, run from Terminal or the fake app, plus the stealer’s binary. Unit 42 stresses that its domains, addresses and file names change often. ## Indicators As the sources document them. Domains are text, never links, and are defanged (`[.]`) where the source defangs them. Most of this infrastructure is long gone: indicators help you check old logs, files and accounts, not block today’s campaigns. | Indicator | Type | Where it shows | Note | |---|---|---|---| | `brewe[.]sh` | Domain | Browser | Lookalike Homebrew site behind a sponsored result, January 2025 (Moonlock). | | `hxxps://norikosumiya[.]com/brew/update` | URL | Terminal (curl) | Where that site’s install command fetched AMOS (Moonlock). | | `aricl[.]net, airci[.]net` | Domains | Browser | Fake Arc browser download sites, 2024 (Jamf). | | `alliai[.]com, alli-ai[.]pro, ai[.]foqguzz[.]com, day[.]foqguzz[.]com` | Domains | Browser, the fake app | Redirects, the AlliAi.dmg download and its first connection, January 2026 (Microsoft). | | `hxxp://217.119.139[.]117/log` | URL on a bare IP | Your Mac | Next-stage download (`/d/…`) and exfiltration, over plain HTTP (Microsoft). | | `getmacouscloud[.]com, ferncore13[.]com, grove-89[.]com` | Domains | Browser, Terminal (curl) | The fake toolkit page, the host of the script and binary, and a third host Unit 42 lists, 2026. | | `161.35.146[.]120, 188.166.78[.]138` | IP addresses | Your Mac | Server for the `stage=…` uploads on 5 August and 31 July 2026 (Unit 42). | | `clearl[.]co` | Domain | Browser | Fake AI agent tool, Cleal_AI.dmg, March 2026 (Moonlock). | | `/tmp/helper, /tmp/starter, /tmp/out.zip, /Library/LaunchDaemons/com..plist` | Files | Your Mac | The binary, a plist, the staged data, and the persistence of the January 2026 variant (Unit 42, Microsoft). | ## What Kilobat would have shown or blocked - **[Protection](https://kilobat.app/mac-malware-blocker).** Kilobat checks every app’s connections, the browser’s, Terminal’s and curl’s, against HaGeZi’s Threat Intelligence Feeds (domains and IP addresses), HaGeZi Fake and URLhaus, and refuses what they list, naming the app. A host or address that was listed on the day would have been blocked, page, payload or server. When we checked on 1 November 2026, none of the hosts and addresses in the table above were on those lists any more: lists drop infrastructure that has gone dark, and whether each one was listed while it was live can’t be checked now. - **[Ask about new apps](https://kilobat.app/guides/recipes/approve-new-apps).** With **Ask about new apps** on, in the Travel or Work profile, the first connection of an app with no rule is held while Kilobat shows who signed it, its path and where it wants to go. An unsigned or ad-hoc signed app from a disk image, or a binary running from `/tmp`, would wait for your answer. With **Allow Apple Software** on, Apple’s `curl` and `osascript` are let through. - **[App traffic](https://kilobat.app/mac-bandwidth-monitor).** Kilobat’s app list names command-line tools that aren’t part of macOS by their path, so `/tmp/helper` sending data stands out, with its upload and destination. A connection by bare address shows the address. ## Where Kilobat wouldn’t have helped - Kilobat isn’t antivirus. It doesn’t stop you pasting a command, opening a disk image or typing your password into a fake dialog; keep XProtect and Gatekeeper on. - Most of the theft happens before any connection. Reading the keychain, browser profiles and wallets is local, and only the final upload touches the network. - Fresh lure sites and servers aren’t on any list yet. Moonlock found the fake AI tool’s site undetected by every engine on VirusTotal while it was live. - What was stolen is used from the attackers’ machines, with your cookies and passwords, so nothing more shows on your Mac. - The agent guard and agent network log don’t apply to programs you start yourself from Terminal or Finder. ## Check your Mac now 1. Look for launch items you don’t recognise. AMOS has used `com.` followed by random letters. ``` ls -la /Library/LaunchDaemons /Library/LaunchAgents ~/Library/LaunchAgents ``` 2. Look for the hidden folders Unit 42 found, named to look like Apple’s. They don’t normally exist. ``` ls -la ~/Library/Application\ Support/.com.apple.accountsd ~/Library/Application\ Support/.com.apple.metadata.mds ``` 3. Look for staged files. macOS clears `/tmp` on restart, so finding nothing proves little. ``` ls -la /tmp/helper /tmp/starter /tmp/out.zip ``` 4. Look through your shell history for a command pasted from a web page that downloads and runs something. ``` grep -nE "curl .*\| *(ba|z)?sh|base64 -(d|D)" ~/.zsh_history ``` 5. Install Homebrew only with the command on `brew.sh`, which fetches `raw.githubusercontent.com/Homebrew/install/HEAD/install.sh`. Before you run any install command, check the host it downloads from. ``` kilobat protect check example-download-host.com ``` 6. Turn on Ask about new apps, with Apple software allowed, so new programs wait for you. See [Get approvals for new apps](https://kilobat.app/guides/recipes/approve-new-apps). ``` kilobat settings new-apps ask ``` 7. If you find signs of AMOS, assume your saved passwords, browser sessions, keychain and wallets are exposed. From another device, change passwords, sign out of other sessions and move crypto to a new wallet, then erase and reinstall macOS rather than trusting a cleanup. ## Questions **Does Gatekeeper stop AMOS?** Not when people are talked past it. Jamf saw disk images that told users to right-click and open the app, and paste-into-Terminal variants never present an app to Gatekeeper at all. Keep it on anyway; it stops plenty. **Would Kilobat have blocked the fake Homebrew site?** Only if brewe[.]sh or the payload domain was on the threat lists while the ad ran, for about three days in January 2025. That can’t be checked after the fact, and it isn’t listed now. ## Sources - [Cyble: Threat actor selling new Atomic macOS (AMOS) stealer on Telegram](https://cyble.com/blog/threat-actor-selling-new-atomic-macos-amos-stealer-on-telegram/) - [SentinelOne: Atomic Stealer, threat actor spawns second variant of macOS malware sold on Telegram](https://www.sentinelone.com/blog/atomic-stealer-threat-actor-spawns-second-variant-of-macos-malware-sold-on-telegram/) - [Jamf Threat Labs: Infostealers continue to pose threat to macOS users](https://www.jamf.com/blog/infostealers-pose-threat-to-macos/) - [Moonlock: Dangerous macOS malware is spread via fake Homebrew ads](https://moonlock.com/macos-malware-homebrew-ads) - [Microsoft Defender Experts: Hunting infostealers, macOS threats](https://techcommunity.microsoft.com/blog/microsoftsecurityexperts/hunting-infostealers---macos-threats/4494435) - [Moonlock: Atomic macOS stealer is mimicking an AI agent tool for Mac](https://moonlock.com/amos-mimicking-ai-agent-tool) - [Unit 42: Atomic macOS (AMOS) stealer activity](https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/) Checked on 1 November 2026. ## See what your agents and apps connect to Kilobat is a Mac menu-bar app that names the app, process and agent behind every connection, keeps them away from known-bad hosts, and logs what each agent session reached. [Download for Mac ↓](https://kilobat.app/downloads/Kilobat-1.31.1.dmg?via=site) ``` brew install seifip/kilobat/kilobat ``` ## More incidents - [Nx “s1ngularity”](https://kilobat.app/incidents/nx-s1ngularity): Malicious Nx versions ran installed AI CLIs to find secrets, then published them to a new repository in the victim’s GitHub account. - [The “Shai-Hulud” npm worm](https://kilobat.app/incidents/shai-hulud-npm-worm): A worm that stole developers’ tokens, republished itself with them, and leaked secrets through GitHub and webhook.site. - [All incidents](https://kilobat.app/incidents): Every case study, with what Kilobat would and wouldn’t have done.