Atomic macOS Stealer

What Atomic macOS Stealer takes

• Passwords from the macOS Keychain
• Browser passwords, cookies, autofill, and cards
• Cryptocurrency wallets
• Files from the desktop and documents folders

How it spreads

• Fake installers for popular Mac apps
• Search ads that lead to look-alike download sites
• Fake browser update pages

Background

Atomic asks for the Mac password with a prompt that looks like a system dialog. That password opens the Keychain, which holds more than the browser store.

Many Mac owners assume stealers are a Windows problem. That assumption is part of why AMOS works. Logs from those machines sit in the same Telegram channels as Windows dumps.

Checking for your logins

Search an email, username, company domain, login URL, password, or IP. The index covers logs from every family, Atomic macOS Stealer included. A dump usually does not record which malware wrote it, so a result will not say it was Atomic macOS Stealer.

The steps afterwards are the same either way. Clean the device, then change passwords from a machine that was not infected. What to do.

Other families

• RedLine Stealer. For years the most common Windows stealer in circulating logs.
• Lumma Stealer. Often delivered by fake verify-you-are-human pages.
• Vidar. A long-running Windows stealer, often dropped with other malware.
• Raccoon Stealer. A cheap Windows stealer. Its alleged operator was arrested in 2022.
• StealC. A 2023 Windows stealer that copies features from older families.