#atomicstealer — Public Fediverse posts

ClickFix Campaign Targets macOS Users with Atomic Stealer Malware

A macOS ClickFix campaign spanning over 250 domains now uses browser fingerprinting to hide its fake "Download for macOS" lure from crawlers and researchers, while still serving it to genuine Mac users who are tricked into running a Terminal command that deploys the AMOS infostealer.

Pulse ID: 6a74853991cc8881d222ead0
Pulse Link: https://otx.alienvault.com/pulse/6a74853991cc8881d222ead0
Pulse Author: cryptocti
Created: 2026-08-06 12:59:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AMOS #Atomic #AtomicStealer #Browser #CyberSecurity #InfoSec #InfoStealer #Mac #MacOS #Malware #OTX #OpenThreatExchange #bot #cryptocti

ClickFix Campaign Targets macOS Users with Atomic Stealer Malware

A macOS ClickFix campaign spanning over 250 domains now uses browser fingerprinting to hide its fake "Download for macOS" lure from crawlers and researchers, while still serving it to genuine Mac users who are tricked into running a Terminal command that deploys the AMOS infostealer.

Pulse ID: 6a74853991cc8881d222ead0
Pulse Link: https://otx.alienvault.com/pulse/6a74853991cc8881d222ead0
Pulse Author: cryptocti
Created: 2026-08-06 12:59:37

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AMOS #Atomic #AtomicStealer #Browser #CyberSecurity #InfoSec #InfoStealer #Mac #MacOS #Malware #OTX #OpenThreatExchange #bot #cryptocti

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

Microsoft Threat Intelligence identified a macOS ClickFix operation distributing infostealers including MacSync and Atomic Stealer through over 250 algorithmically generated domains. The campaign evolved from openly displaying malicious content to implementing server-side browser fingerprinting that only reveals lures to visitors whose environment matches genuine macOS browsers. The fingerprinting gate collects browser attributes, hardware details via WebGL, and environmental characteristics to filter out crawlers and sandboxes. Victims are shown fake download pages with Terminal commands that retrieve remote scripts, ultimately deploying AMOS infostealer to harvest credentials, browser data, cryptocurrency wallets, and authentication stores. This Traffic Distribution System approach significantly reduces visibility for security researchers and automated analysis tools while maintaining access to intended targets. The operation represents a notable shift in tradecraft, adding sophisticated cloaking to exis...

Pulse ID: 6a73869b069fb3586fddadf9
Pulse Link: https://otx.alienvault.com/pulse/6a73869b069fb3586fddadf9
Pulse Author: AlienVault
Created: 2026-08-05 18:53:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AMOS #Atomic #AtomicStealer #Browser #CyberSecurity #ICS #InfoSec #InfoStealer #Mac #MacOS #Microsoft #OTX #OpenThreatExchange #RAT #bot #cryptocurrency #AlienVault

From open lures to cloaked gates: How a macOS ClickFix campaign learned to hide

Microsoft Threat Intelligence identified a macOS ClickFix operation distributing infostealers including MacSync and Atomic Stealer through over 250 algorithmically generated domains. The campaign evolved from openly displaying malicious content to implementing server-side browser fingerprinting that only reveals lures to visitors whose environment matches genuine macOS browsers. The fingerprinting gate collects browser attributes, hardware details via WebGL, and environmental characteristics to filter out crawlers and sandboxes. Victims are shown fake download pages with Terminal commands that retrieve remote scripts, ultimately deploying AMOS infostealer to harvest credentials, browser data, cryptocurrency wallets, and authentication stores. This Traffic Distribution System approach significantly reduces visibility for security researchers and automated analysis tools while maintaining access to intended targets. The operation represents a notable shift in tradecraft, adding sophisticated cloaking to exis...

Pulse ID: 6a73869b069fb3586fddadf9
Pulse Link: https://otx.alienvault.com/pulse/6a73869b069fb3586fddadf9
Pulse Author: AlienVault
Created: 2026-08-05 18:53:15

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#AMOS #Atomic #AtomicStealer #Browser #CyberSecurity #ICS #InfoSec #InfoStealer #Mac #MacOS #Microsoft #OTX #OpenThreatExchange #RAT #bot #cryptocurrency #AlienVault

250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks

Indicators extracted from public reporting. Source: https://cybersecuritynews.com/158536-2250-macos-clickfix-domains/

Pulse ID: 6a7421ea3cb7d6ca6a2de878
Pulse Link: https://otx.alienvault.com/pulse/6a7421ea3cb7d6ca6a2de878
Pulse Author: CyberHunter_NL
Created: 2026-08-06 05:55:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Atomic #AtomicStealer #Browser #CyberSecurity #HTTP #HTTPS #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

250+ macOS ClickFix Domains Use Browser Fingerprinting to Hide Atomic Stealer Attacks

Indicators extracted from public reporting. Source: https://cybersecuritynews.com/158536-2250-macos-clickfix-domains/

Pulse ID: 6a7421ea3cb7d6ca6a2de878
Pulse Link: https://otx.alienvault.com/pulse/6a7421ea3cb7d6ca6a2de878
Pulse Author: CyberHunter_NL
Created: 2026-08-06 05:55:54

Be advised, this data is unverified and should be considered preliminary. Always do further verification.

#Atomic #AtomicStealer #Browser #CyberSecurity #HTTP #HTTPS #InfoSec #Mac #MacOS #OTX #OpenThreatExchange #RCE #bot #CyberHunter_NL

MacOS ClickFix Attack Exploits Script Editor to Evade Apple Warnings

The cat-and-mouse game continues: after Apple added security warnings to Terminal, attackers behind the Atomic Stealer family adapted their ClickFix attack to exploit Script Editor instead. This latest move shows how adversaries constantly evolve to evade detection.

https://osintsights.com/macos-clickfix-attack-exploits-script-editor-to-evade-apple-warnings?utm_source=mastodon&utm_medium=social

#Macos #ClickfixAttack #AtomicStealer #MalwareOperations #EmergingThreats

ah ben voilà, je me disais : quand est-ce que le bon vieux AppleScript allait être intégré dans les campagnes ClickFix visant macOS ?

Il aura fallu qu’Apple introduise sa nouvelle fonctionnalité de protection du copier/coller dans le Terminal
( d'ailleurs et comme d'hab 😁 « largement inspirée », par le travail de Patrick Wardle dans blockblock :
https://objective-see.org/blog/blog_0x87.html )

…pour que la campagne Atomic Stealer passe à Script Editor.
⬇️
ClickFix technique uses Script Editor instead of Terminal on macOS
Jamf Threat Labs discovered a ClickFix-style macOS attack that abuses the applescript:// URL scheme to launch Script Editor and deliver an Atomic Stealer infostealer payload — bypassing Terminal entirely.
👇
https://www.jamf.com/blog/clickfix-macos-script-editor-atomic-stealer/

#cyberveille #macos #atomicstealer

Forschende von Jamf Threat berichten heute über eine neue Variante einer bekannten Cyberangriffsmethode. Der Angriff zielt auf Mac-Nutzende ab und nutzt eine ziemlich geschickte Täuschung, um Schadsoftware auf den Mac zu schleusen.

Mehr: https://digiprax.maniabel.work/archiv/1248

#infostealer #AtomicStealer #jamf #infosec #up2date #macOS #ScriptEditor #ClickFix

macOS Users Targeted in ClickFix Malware Campaign

macOS users are being targeted in a sneaky new malware campaign called ClickFix, which tricks them into executing malicious commands by abusing the Script Editor and Terminal tools. This latest attack raises a pressing question: how can we trust our trusted tools when they're being exploited by hackers?

https://osintsights.com/macos-users-targeted-in-clickfix-malware-campaign?utm_source=mastodon&utm_medium=social

#Macos #AtomicStealer #Clickfix #MalwareOperations #EmergingThreats

Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer
#OpenClaw #AtomicStealer
https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html

Malicious OpenClaw Skills Used to Distribute Atomic MacOS Stealer
#OpenClaw #AtomicStealer
https://www.trendmicro.com/en_us/research/26/b/openclaw-skills-used-to-distribute-atomic-macos-stealer.html

Infostealers without borders: macOS, Python stealers, and platform abuse
#DigitStealer #MacSyncStealer #AtomicStealer #PXAStealer
https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/

Infostealers without borders: macOS, Python stealers, and platform abuse
#DigitStealer #MacSyncStealer #AtomicStealer #PXAStealer
https://www.microsoft.com/en-us/security/blog/2026/02/02/infostealers-without-borders-macos-python-stealers-and-platform-abuse/

🚨 Fake Malwarebytes, LastPass & 70+ brands abused on GitHub to spread Atomic Stealer (AMOS).
🔹 Fake repos + SEO + sponsored ads = malware installs
🔹 Copy-paste terminal commands (curl … | bash) deliver the payload instantly
🔹 Brands targeted include password managers, fintech apps, and dev tools
⚠️ Another reminder: only trust official developer sites.
💬 Do you think GitHub & Google should be held more accountable for catching these campaigns earlier?

Follow @technadu for #CyberSecurity insights.

#Malware #AtomicStealer #AMOS #Infostealer #MacOS #Malwarebytes #LastPass #GitHubSecurity

Fake Malwarebytes, LastPass, and others on GitHub serve malware https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware #informationstealer #MalwarebytesforMac #Atomicstealer #Threats #GitHub #News #amos

Fake Malwarebytes, LastPass, and others on GitHub serve malware https://www.malwarebytes.com/blog/news/2025/09/fake-malwarebytes-lastpass-and-others-on-github-serve-malware #informationstealer #MalwarebytesforMac #Atomicstealer #Threats #GitHub #News #amos

🚨 macOS users are being hit with a widespread infostealer campaign.
LastPass warns that hackers are using fake GitHub repos + SEO tricks to deliver the Atomic Stealer (AMOS) malware.

⚠️ Impersonated brands: password managers, banks, crypto wallets, AI tools
⚠️ Ongoing since July, with multiple fake repos removed
⚠️ Trust in GitHub & Google Ads is being weaponized
💬 How do you think platforms can balance openness with stronger malware detection?
🔔 Follow @technadu for daily cyber threat updates.

#macOS #Infostealer #AtomicStealer #AMOS #GitHubThreats #LastPass #Cybercrime #CyberResilience #TechNadu

Atomic macOS Stealer now includes a backdoor for persistent access
#AtomicStealer
https://moonlock.com/amos-backdoor-persistent-access

Atomic macOS Stealer now includes a backdoor for persistent access
#AtomicStealer
https://moonlock.com/amos-backdoor-persistent-access

Macs targeted by info stealers in new era of cyberthreats https://www.malwarebytes.com/blog/apple/2025/02/macs-targeted-by-info-stealers-in-new-era-of-cyberthreats #Atomicstealer #infostealers #poseidon #Apple #amos

Macs targeted by info stealers in new era of cyberthreats https://www.malwarebytes.com/blog/apple/2025/02/macs-targeted-by-info-stealers-in-new-era-of-cyberthreats #Atomicstealer #infostealers #poseidon #Apple #amos

📬 Lumma Stealer statt KI-App: Malware befällt Windows und macOS
#ITSicherheit #Malware #AMOS #AtomicStealer #EditProAI #KIAnwendungen #KIApps #LummaStealer https://sc.tarnkappe.info/ce0d41

📬 Lumma Stealer statt KI-App: Malware befällt Windows und macOS
#ITSicherheit #Malware #AMOS #AtomicStealer #EditProAI #KIAnwendungen #KIApps #LummaStealer https://sc.tarnkappe.info/ce0d41

Apple picking: Bobbing for Atomic Stealer & other macOS malware
#AtomicStealer
https://redcanary.com/blog/threat-detection/atomic-stealer/

A week in security (September 2 – September 8) https://www.malwarebytes.com/blog/news/2024/09/a-week-in-security-september-2-september-8 #PlannedParenthood #Atomicstealer #hellopervert #lowes #News

Malvertising Campaign Lures Mac Users with Fake Microsoft Teams Ad https://thecyberexpress.com/malvertising-campaign-lures-macos-users-teams/ #TheCyberExpressNews #CybersecurityNews #TheCyberExpress #MicrosoftTeams #FirewallDaily #AtomicStealer #Poseidon #malware #macOS

Malvertising Campaign Lures Mac Users with Fake Microsoft Teams Ad https://thecyberexpress.com/malvertising-campaign-lures-macos-users-teams/ #TheCyberExpressNews #CybersecurityNews #TheCyberExpress #MicrosoftTeams #FirewallDaily #AtomicStealer #Poseidon #malware #macOS

Fake Microsoft Teams for Mac delivers Atomic Stealer https://www.malwarebytes.com/blog/threat-intelligence/2024/07/fake-microsoft-teams-for-mac-delivers-atomic-stealer #ThreatIntelligence #MicrosoftTeams #Atomicstealer #malvertising #Apple #mac

Fake Microsoft Teams for Mac delivers Atomic Stealer https://www.malwarebytes.com/blog/threat-intelligence/2024/07/fake-microsoft-teams-for-mac-delivers-atomic-stealer #ThreatIntelligence #MicrosoftTeams #Atomicstealer #malvertising #Apple #mac

‘Poseidon’ Mac stealer distributed via Google ads https://www.malwarebytes.com/blog/cybercrime/2024/06/poseidon-mac-stealer-distributed-via-google-ads #ThreatIntelligence #Atomicstealer #Cybercrime #poseidon #mac

‘Poseidon’ Mac stealer distributed via Google ads https://www.malwarebytes.com/blog/cybercrime/2024/06/poseidon-mac-stealer-distributed-via-google-ads #ThreatIntelligence #Atomicstealer #Cybercrime #poseidon #mac

Malicious ad for Arc browser -> #AtomicStealer

arcthost[.]org
arc-download[.]com
zestyahhdog[.]com/Arc12645413[.]dmg

C2: 79.137.192[.]4/p2p

#malvertising #threatintel

Malicious ad for Arc browser -> #AtomicStealer

arcthost[.]org
arc-download[.]com
zestyahhdog[.]com/Arc12645413[.]dmg

C2: 79.137.192[.]4/p2p

#malvertising #threatintel

🚨 Malicious Zoom ad for Mac & Windows 🚨

Google ad ➡️ Fake Zoom site ➡️ Payload🔑

🤓 Fake advertiser: Jessica Babcok
⚠️ Zoom site: zocmstranslate[.]com

🔹Mac (#atomicstealer, C2: 5.182.86[.]95)
🔹Windows (#LummaStealer, C2: stiffraspyofkwsl[.]shop)

#malvertising #threatintel

🚨 Malicious Zoom ad for Mac & Windows 🚨

Google ad ➡️ Fake Zoom site ➡️ Payload🔑

🤓 Fake advertiser: Jessica Babcok
⚠️ Zoom site: zocmstranslate[.]com

🔹Mac (#atomicstealer, C2: 5.182.86[.]95)
🔹Windows (#LummaStealer, C2: stiffraspyofkwsl[.]shop)

#malvertising #threatintel

Jamf warns of two ongoing infostealer campaigns target macOS environments: Atomic Stealer being spread through Sponsored Ads (malvertising) and the attempted execution of an unsigned executable with a bad hash from Meethub. "Many of these stealers are targeting individuals involved in the crypto industry with a focus on harvesting credentials along with data from various crypto wallets." Attack chains described, IOC provided. 🔗 https://www.jamf.com/blog/infostealers-pose-threat-to-macos/

#infostealer #threatintel #IOC #AtomicStealer #Meethub

Jamf warns of two ongoing infostealer campaigns target macOS environments: Atomic Stealer being spread through Sponsored Ads (malvertising) and the attempted execution of an unsigned executable with a bad hash from Meethub. "Many of these stealers are targeting individuals involved in the crypto industry with a focus on harvesting credentials along with data from various crypto wallets." Attack chains described, IOC provided. 🔗 https://www.jamf.com/blog/infostealers-pose-threat-to-macos/

#infostealer #threatintel #IOC #AtomicStealer #Meethub

📬 Infostealer-Angriffe auf macOS-User nehmen drastisch zu
#ITSicherheit #Malware #ArcBrowser #AtomicStealer #Infostealer #macOS #Malwaretising #meethub #Realst https://sc.tarnkappe.info/5c5a58

📬 Infostealer-Angriffe auf macOS-User nehmen drastisch zu
#ITSicherheit #Malware #ArcBrowser #AtomicStealer #Infostealer #macOS #Malwaretising #meethub #Realst https://sc.tarnkappe.info/5c5a58

Dark Web Actor Selling Source Code for Rust-Based Information Stealer https://thecyberexpress.com/source-code-sale-of-new-information-stealer/ #informationstealers #InformationStealer #TheCyberExpress #FirewallDaily #AtomicStealer #AsukaStealer #DarkWebNews #InfoStealer #Crackingx

Atomic Stealer rings in the new year with updated version
https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version

#malvertising #macos #atomicstealer #threatintel

Atomic Stealer rings in the new year with updated version
https://www.malwarebytes.com/blog/threat-intelligence/2024/01/atomic-stealer-rings-in-the-new-year-with-updated-version

#malvertising #macos #atomicstealer #threatintel

It’s not all rosy in the land of macOS, as a new malware variant has been discovered that explicitly targets Apple users. Luckily, there are things you can do to protect yourself.

#apple #macos #malware #atomicstealer
https://tchlp.com/46CY9GC

It’s not all rosy in the land of macOS, as a new malware variant has been discovered that explicitly targets Apple users. Luckily, there are things you can do to protect yourself.

#apple #macos #malware #atomicstealer
https://tchlp.com/46CY9GC

La campaña ClearFake implementa #malware #AtomicStealer para macOS

#ciberseguridad #CyberSecurity #macOS

https://mecambioamac.com/la-campana-clearfake-implementa-malware-atomic-stealer-para-macos/

Atomic Stealer, also referred to as AMOS, was initially documented in April 2023.

#Cybersecurity #Apple #Malware #ClearFake #AtomicStealer #macOs

https://cybersec84.wordpress.com/2023/11/23/atomic-stealer-malware-targets-macs-via-expanded-clearfake-campaign/

Atomic Stealer, also referred to as AMOS, was initially documented in April 2023.

#Cybersecurity #Apple #Malware #ClearFake #AtomicStealer #macOs

https://cybersec84.wordpress.com/2023/11/23/atomic-stealer-malware-targets-macs-via-expanded-clearfake-campaign/

Only 10 days into October and still lots of new #macOS #apple #AtomicStealer variants all over VT.
57 and counting...
Want to play? See the updated #malware IOCs for October here:
https:/s1.ai/amos

Only 10 days into October and still lots of new #macOS #apple #AtomicStealer variants all over VT.
57 and counting...
Want to play? See the updated #malware IOCs for October here:
https:/s1.ai/amos

KrebsonSecurity: ‘Snatch’ Ransom Group Exposes Visitor IP Addresses https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/ #TrustwaveSpiderlabs #Ne'er-Do-WellNews #MihailKolesnikov #8BaseRansomware #DomainTools.com #MicrosoftTeams #AtomicStealer #DataBreaches #Malwarebytes #Breadcrumbs #Ransomware #Google.com #@htmalgae #Rilide

KrebsonSecurity: ‘Snatch’ Ransom Group Exposes Visitor IP Addresses https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/ #TrustwaveSpiderlabs #Ne'er-Do-WellNews #MihailKolesnikov #8BaseRansomware #DomainTools.com #MicrosoftTeams #AtomicStealer #DataBreaches #Malwarebytes #Breadcrumbs #Ransomware #Google.com #@htmalgae #Rilide

‘Snatch’ Ransom Group Exposes Visitor IP Addresses https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/ #TrustwaveSpiderlabs #Ne'er-Do-WellNews #MihailKolesnikov #8BaseRansomware #DomainTools.com #MicrosoftTeams #AtomicStealer #DataBreaches #Malwarebytes #Breadcrumbs #Ransomware #Google.com #@htmalgae #Rilide

‘Snatch’ Ransom Group Exposes Visitor IP Addresses

https://krebsonsecurity.com/2023/09/snatch-ransom-group-exposes-visitor-ip-addresses/

#TrustwaveSpiderlabs #Ne'er-Do-WellNews #MihailKolesnikov #8BaseRansomware #DomainTools.com #MicrosoftTeams #AtomicStealer #DataBreaches #Malwarebytes #Breadcrumbs #Ransomware #Google.com #@htmalgae #Rilide

Malvertising-Kampagne will Mac-Nutzern #AtomicStealer unterjubeln | Security https://www.heise.de/news/Malvertising-Kampagne-will-Mac-Nutzern-Atomic-Stealer-unterjubeln-9298637.html #cryptocurrencies #cryptocurrency

This development comes as macOS systems are increasingly becoming viable targets for malware attacks.

#cyberthreat #Apple #malware #macOS #AtomicStealer

https://cybersec84.wordpress.com/2023/09/09/mac-users-be-warned-new-malware-campaign-spreads-atomic-stealer/