Atomic Stealer (AMOS) is a macOS password and crypto-wallet stealer, sold to criminals on Telegram since 2023, that arrives as a fake app download or a command a website tells you to paste into Terminal. If an app you just downloaded asked for your Mac password straight away, delete it and change the passwords saved in your browser and Keychain from another device.
Last reviewed · 3 sources
Also known as: AMOS, Atomic macOS Stealer
Atomic Stealer (AMOS) is a macOS information stealer that Cyble found advertised on Telegram in April 2023 for $1,000 a month, sold together with a .dmg installer. It collects Keychain passwords, browser passwords, cookies, autofill and card data, crypto wallets, files from the Desktop and Documents folders, and your Mac password, which it gets with a fake password prompt. Microsoft reported in 2025 that ClickFix pages were delivering it to Mac users through a command pasted into Terminal.
Disk images (.dmg) that pose as well-known apps, offered on look-alike download sites
Sponsored search results that lead to those download pages
ClickFix pages that tell you to paste a command into Terminal (Microsoft, 2025)
Cracked software shared on forums and Telegram channels
A password prompt right after opening an app you just downloaded
An installer that told you to right-click and Open it, or to get past a Gatekeeper warning
Browser sessions signed out, or crypto wallet activity you don't recognize
A Terminal command you pasted from a website shortly before
Turn off Wi-Fi or unplug Ethernet so nothing more can be sent while you clean up.
Quit the app (use Force Quit in Activity Monitor if it won't close), then move it and the .dmg it came in to the Trash.
Open System Settings › General › Login Items & Extensions (Login Items before macOS 15), and look in ~/Library/LaunchAgents, /Library/LaunchAgents and /Library/LaunchDaemons for anything added around the same time.
Change the passwords stored in your browsers and Keychain, starting with email, banking and crypto exchanges, and turn on two-factor authentication. Move crypto to a new wallet created on a device you trust.
CoreLock's free scan checks startup items and compares the files in your Downloads folder against a built-in malware-hash list and 19 YARA rules. A match is shown as worth a look with what matched; CoreLock never quarantines a file on its own, and it can't promise to find everything a stealer left behind.
Download apps only from the Mac App Store or the developer's own website
Don't override a Gatekeeper warning for an app you just downloaded
Be careful with sponsored search results for app downloads
Never paste a command from a website into Terminal
What it can and can't do
Atomic Stealer usually lands in your Downloads folder as a disk image, and CoreLock's free Downloads check compares files there against a built-in malware-hash list and 19 YARA rules, showing a match as worth a look without quarantining it. The scan's startup-items check covers what is set to launch at login; neither can promise to catch every variant.
Stealer — Realst is a macOS information stealer written in Rust. Security researcher iamde...
Stealer — Banshee Stealer appeared in mid-2024 and was rented out for $3,000 a month throu...
Stealer — Uptycs found MacStealer advertised on the dark web in March 2023, sold as builds...
Cyble's April 2023 analysis lists Keychain passwords, browser passwords, cookies, autofill and card data, crypto wallets, files from the Desktop and Documents folders, system information and your Mac password. It gets the password by showing a fake system prompt.
Think back to apps you installed from outside the App Store, especially any that asked for your password as soon as they opened, and to any command you pasted into Terminal from a website. Check Login Items and the LaunchAgents folders for entries you don't recognize, and look in Downloads for the .dmg it came in. CoreLock's free scan checks startup items and the Downloads folder, but no scan can confirm a Mac is clean.
Apple updates XProtect's signatures on their own schedule, separately from macOS updates. XProtect 5368 (on macOS 26.5, checked October 29, 2026) includes a rule whose name contains AMOS. New builds can still get through before Apple adds them, which is why what you choose to open matters most.
Yes. Microsoft wrote in August 2025 that a ClickFix campaign was delivering Atomic macOS Stealer to Mac users in June 2025, by getting them to paste a command into Terminal.
Free, with no account: the scan checks your Downloads folder against a built-in malware-hash list and 19 YARA rules.
Apple silicon build 2.0.7 · Intel Mac?
For your Mac, not this phone ·
Count which apps can record your screen, use your mic or camera, or read your files, and get a free 0–100 estimate in your browser.
Estimate your Security ScoreFree · Calculated in your browser