Weaponized DMG Installers Spread macOS Infostealers Including AMOS
Threat actors are increasingly using weaponized .dmg files disguised as legitimate macOS software installers to deliver infostealer malware, with campaigns relying heavily on social engineering to convince users to bypass Apple Gatekeeper and other trust prompts. Researchers said the malware typically focuses on rapid collection and exfiltration rather than persistence, stealing browser credentials, cookies, authentication tokens, Apple Keychain data, macOS passwords, and cryptocurrency wallet information from infected systems.
Multiple macOS stealer families have been tied to the tactic, including Atomic macOS Stealer (AMOS), Poseidon, Odyssey, and MacSync. AMOS in particular has been marketed as malware-as-a-service and distributed through malvertising, SEO poisoning, fake download pages, social media ads, GitHub-hosted binaries, open directories, poisoned search results, and piracy forums while impersonating popular apps such as Notion, Trello, Arc, Slack, Todoist, and CleanMyMac X. Defenders were urged to monitor suspicious DMG mount activity in /Volumes, inspect hidden .background directories, use OCR on installer graphics, unmount suspicious disk images quickly, and restrict software installation to legitimate, Apple-verified sources outside unofficial or cracked-software channels.
Get ahead of threats like this
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
How this story unfolded
5 events from the most recent confirmed update back to the earliest known activity.
CyberProof reports renewed AMOS campaigns targeting Keychain and developer files
CyberProof reported renewed Atomic macOS Stealer activity in financially motivated campaigns using deceptive software downloads, fake websites, and social-engineering lures. The report said AMOS used native macOS tools to steal browser data, the macOS Keychain database, and developer files, then exfiltrated the data via HTTP PUT to bestbuydomain.com with retry and cleanup logic.
macOS infostealers dominate newly reported malware in 2025
Huntress reported that in 2025, more than 65% of newly reported macOS malware was classified as infostealers. The finding reflects a shift toward treating Apple systems as high-value targets for credential and wallet theft.
Cyble first reports Atomic macOS Stealer (AMOS)
Sophos states that Atomic macOS Stealer was first reported by Cyble in April 2023. AMOS was described as a macOS infostealer sold via Telegram as malware-as-a-service.
Bitdefender identifies new Atomic Stealer variant in the wild
Bitdefender reported a new and largely undetected macOS variant of Atomic Stealer (AMOS) found in malicious DMG files. The company detailed its Python-and-AppleScript theft chain, browser and wallet targeting, C2 endpoint, and said code similarities with RustDoor supported prior attribution of AMOS to a Russian threat actor.
SentinelOne documents Atomic Stealer variants sold via Telegram
SentinelOne published analysis of Atomic Stealer (AMOS), a macOS infostealer marketed on Telegram for $1,000 per month. The report described multiple variants, AppleScript-based credential theft, targeted browser and wallet data, and related infrastructure and indicators.
Related entities
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
Sources
6 references tracked. Mallory keeps watching after this page renders.
Amos Stealer Targets macOS Keychain Files and Browser Passwords
hackread.com
Open sourceHackers Use Weaponized DMG Files to Target macOS Users With Infostealer Malware - Cyber Security News
cybersecuritynews.com
Open sourceAtomic macOS Stealer leads sensitive data theft on macOS | SOPHOS
news.sophos.com
Open sourceApple picking: Bobbing for Atomic Stealer & other macOS malware | Red Canary
redcanary.com
Open sourceWhen Stealers Converge: New Variant of Atomic Stealer in the Wild
bitdefender.com
Open sourceAtomic Stealer: New Variant of macOS Malware on Telegram
sentinelone.com
Open sourceSee the full picture, correlated to your attack surface.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Related stories
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
AMOS Mac Malware Spreads via Fake Ads and Trojanized macOS Downloads
Researchers reported multiple campaigns distributing macOS infostealers tied to the **AMOS/AtomicStealer** ecosystem, a malware-as-a-service operation that steals credentials, browser data, cryptocurrency wallets, Apple Notes, files, and **Keychain** material from macOS Catalina and newer systems on Intel, M1, and M2 devices. Earlier reporting on related macOS stealers showed operators relying on social engineering, unsigned DMG files, and password prompts to collect sensitive data, package it into archives, and exfiltrate it to command-and-control servers, with some activity also summarized to Telegram channels. More recent campaigns used **malvertising** and fake software or troubleshooting pages to lure users into running Terminal commands that fetched an AMOS variant known as **"malext"**. Investigators said the malware used obfuscated shell commands, `osascript`, quarantine removal, anti-VM and sandbox checks, and in some cases installed persistence through a LaunchDaemon and helper scripts, while also trojanizing Ledger and Trezor applications and capturing administrator passwords. Reporting also linked AMOS delivery to fake **CleanMyMac** sites and AI-themed lures, indicating operators are rapidly rotating ad accounts and adapting infection vectors to broaden theft and remote access on macOS systems.
May 25, 2026
Microsoft Warns macOS Infostealer Campaigns Using ClickFix Lures, Malicious DMGs, and Python Stealers
Microsoft reported that **information-stealing malware activity is expanding from Windows to macOS**, driven by campaigns observed since late 2025 that rely on social engineering and cross-platform tooling. The activity includes **ClickFix-style prompts** and **malicious DMG installers** that deliver macOS-focused infostealer families such as **Atomic macOS Stealer (AMOS)**, **MacSync**, and **DigitStealer**, with operators leveraging **fileless execution**, **native macOS utilities**, and **AppleScript automation** to evade defenses and automate collection. Initial access commonly starts with **malicious search ads (e.g., Google Ads)** that redirect users to fake sites impersonating legitimate tools and then trick victims into running “fix” steps or installing trojanized software. The malware is assessed to target high-value data including browser credentials and session cookies, **iCloud Keychain** contents, crypto wallet data, and **developer secrets**; Microsoft also highlighted growing use of **Python-based stealers** distributed via phishing for rapid adaptation across heterogeneous environments, citing **PXA Stealer** (linked to Vietnamese-speaking actors) as an example used in late-2025 campaigns with persistence mechanisms such as registry `Run` keys or scheduled tasks and **Telegram** used for command-and-control.
Mar 21, 2026
macOS Infostealer Campaigns Using Social Engineering and Evasion Tactics
Threat actors are escalating **macOS infostealer** activity through multiple distribution and evasion techniques aimed at harvesting sensitive user data. One campaign abuses trust in legitimate AI platforms by promoting shareable *ChatGPT* and *Grok* conversation links via **Google Ads**, luring users searching for common macOS troubleshooting help into running malicious Terminal commands using the **“ClickFix”** social-engineering pattern. Executing the provided shell commands results in installation of **Atomic macOS Stealer (AMOS)**, which steals browser credentials, crypto wallet seed phrases, **Keychain** data, and personal files before exfiltrating them to attacker-controlled infrastructure. Separately, **Odyssey Stealer** intrusions against macOS have surged globally, with notable targeting reported in the U.S., France, and Spain and additional impact across Europe, the Americas, and parts of Asia and Africa. Moonlock Lab reporting indicates Odyssey is delivered through **fake software updates, cracked tools, and fraudulent apps**, and is designed to evade detection by generating a **unique fingerprint per infection**, frequently changing code structure, and using many distinct **SHA-256** variants—suggesting automated builders are being used to produce large numbers of hard-to-block samples. Collectively, the reporting highlights sustained pressure on macOS users from credential-stealing malware that blends high-trust lures with rapid variant generation to hinder traditional defenses.
Mar 21, 2026