A sophisticated information stealing malware known as AMOS is rapidly gaining traction among cybercriminals, presenting a growing risk to macOS users. Researchers have tracked multiple campaigns that distribute the malware through fraudulent ads and fake software updates.
How AMOS Infects Macs
The malware, short for Atomic macOS Stealer, relies heavily on social engineering. Victims encounter malicious ads or pop ups that mimic legitimate software download pages. Once installed, AMOS targets sensitive data stored in browsers, password managers and cryptocurrency wallets.
Attackers have refined the delivery method over the past year. Early versions required users to bypass macOS security warnings. Newer variants use advanced obfuscation techniques to avoid detection by built in protections.
What the Malware Steals
AMOS is designed to extract a wide range of credentials. It captures saved passwords from Chrome, Safari and Firefox browsers. It also targets session cookies, credit card data and auto fill information.
Cryptocurrency users face particular danger. The malware scans for wallet software and private key files stored on the infected machine. Security firms report that stolen data is often sold on dark web marketplaces.
Why This Matters
For years macOS users enjoyed a relative safety from widespread malware compared to Windows. AMOS challenges that assumption. The malware is now distributed through mainstream channels such as Google Ads and compromised websites.
Anyone who uses a Mac for online banking, cryptocurrency or sensitive work needs to take the threat seriously. Traditional advice about avoiding sketchy downloads no longer fully protects users when attackers mimic trusted brands.
Security researchers also note that AMOS is sold as a malware as a service subscription. This business model lowers the barrier for less skilled attackers to launch sophisticated campaigns. The trend suggests the number of macOS malware incidents will continue rising.
Apple has not issued a widespread security advisory specific to AMOS. However, users can reduce risk by enabling two factor authentication on all accounts, using password managers that detect phishing and avoiding the download of software from third party ad links.
