AMOS stealer steals MacOS files and browsing data

A new variant of the AMOS (Atomic) Stealer malware has emerged, targeting macOS users with sophisticated techniques to steal sensitive information.

See also: Pirated apps infect macOS systems with malware

Bitdefender's recent analysis highlights this worrying development, revealing the malware's methods and its impact on individual users and organizations.

Stealth intrusion and data theft

First spotted in early 2023, the AMOS stealer has quickly become one of the most prevalent threats to macOS users. This new mutation uses a combination of Python and Apple Script to perform its malicious activities discreetly.

By dropping a Python script on the victim's disk, the malware can collect a wide range of sensitive data, including files related to crypto-wallet extensions, browsing data (passwords, cookies, login data, etc.), files from the Desktop and Documents, hardware and system-related information, and even the local user account password.

One of the most deceptive tactics used by the AMOS stealer is the appearance of a fake dialog that pretends to be the MacOS operating system. When a system update appears, it asks users for the password of their local account, which, if entered, is recorded and used for further malicious activities.

See also: RustDoor: New backdoor targets macOS systems

Bitdefender's recent analysis of the AMOS Stealer code revealed significant similarities to the RustDoor backdoor , suggesting a convergence of tactics between different malware families.

Both types of malware focus on collecting sensitive files from the victim's computer , with AMOS Stealer being a more advanced version capable of additional data theft, including extracting cookies from the MacOS Safari browser

Distribution Tactics

The AMOS Stealer virus spreads via disk image files that are surprisingly small, reducing the chances of arousing suspicion. files contain a FAT binary with Mach-O files for Intel and ARM architectures, acting as a dropper for the Python script.

A common tactic to bypass Apple's security mechanisms involves tricking users into right-clicking and opening a seemingly innocent "Crack Installer" application on the disk image.

See also: SpectralBlur: A new backdoor targeting macOS systems

What are the protection techniques against a stealer malware?

One of the most effective ways to protect against a stealer malware like AMOS for macOS is awareness and training. Users need to know the various types of malware and the ways they can infect their systems. Installing a reliable antimalware software is another important protection technique. This software should be updated regularly so it can handle the latest threats. Using strong passwords and changing them regularly can also help protect against stealer malware. Finally, carefully examining emails and attached files before opening them is another important technique.

Source: gbhackers