OSX.AtomicStealer
ThreatDown is now the name of the Malwarebytes line of business products. References to Malwarebytes below reflect the amazing technology used to first identify the threat.
Short bio
OSX.AtomicStealer is Malwarebytes’ detection name for an information stealer targeting macOS systems otherwise known as AMOS.
Type of infection
OSX.AtomicStealer is distributed under a Malware-As-A-Service (MaaS) model, which means there are several active infection vectors depending on the operators, who get access to the export logs of their victims.
Malicious behavior
During installation and operation OSX.AtomicStealer uses several macOS shell scripts, launched with the osascript utility.
Aftermath
OSX.AtomicStealer steals credentials from several apps on the system which may lead to financial damages and identity theft.
Protection
Malwarebytes/ThreatDown products detect and remove OSX.AtomicStealer