Atomic Stealer (AMOS) is a macOS infostealer sold as malware-as-a-service, harvesting browser data, saved passwords, and cryptocurrency wallets.
Jamf Threat Labs says the Rust macOS stealer pastes itself in via Terminal, fakes an Installer password prompt, mutes the speakers, then hands the operator a headless clone of your logged-in profile.
Perspective Coverage
5 publishersReality
Microsoft Defender Experts tied 30+ domains to a macOS stealer by matching execution, staging and upload behaviour. The count is incidental; the method is the part worth copying.
Perspective Coverage
3 publishersReality
Anthropic is signing affected users out, stripping saved payment methods and issuing refunds after someone began pulling Claude cookies out of ordinary stealer logs and spending other people's quota.
Perspective Coverage
7 publishersReality
Island says the adversary-in-the-middle service runs on at least 755 domains against hundreds of organizations. The session it steals arrives after an authentication the identity provider records as entirely normal.
Reality
Vidar, LummaC2, RedLine and Atomic Stealer are pulling session material that authenticates without a login prompt, so the usual reset-and-enroll response can leave the intruder inside and spending the victim's paid usage.
Reality
The company told affected customers by email, with nothing on its status page, and the only symptom on the user's side was usage that refilled and drained on its own. Watching that burn is now the account holder's job.
Reality