Atomic MacOS Stealer, also called AMOS, is a new infostealer malware that has been making the rounds on the Telegram social network lately. It is an actively developed project, which the most recent update published on April 15th, 2023, and at the time of writing only half of the available antivirus engines can detect it. It targets saved password information and specifically goes after cryptocurrency apps, both desktop and browser extensions.
The malware is sold as a subscription via Telegram at $1,000 per month. Subscribers gain access to the web panel, a MetaMask bruteforce, the .dmg file (which individual users are responsible for distributing), and access to stolen information which is sent out via Telegram.
When the file is first accessed, it opens a fake prompt to collect the victim’s Keychain master password. From there, the Atomic Stealer can gain access to saved autofills, usernames and passwords, and credit cards. It also specifically targets cryptocurrency apps, namely Atomic Wallet (no relation), Binance, Electrum and Exodus as well as 50 browser extensions. The data is packed into a .zip file and sent back to the main server, then handed out to AMOS subscribers. If you were foolish enough to keep your private keys stored on your computer, you can kiss all your money goodbye.
OWN YOUR SECURITY!
We all got into cryptocurrency so we could own our money without depending on the banking system. The trade-off is that we don’t have safeties like deposit insurance or the ability to freeze a compromised account. If someone is able to get your info, like with the Atomic Stealer, you have no recourse. Your coins are your problem, so take your security into your own hands and protect your money.
- Keep your seed phrases OFFLINE. Write them on a physical piece of paper and keep them in a safe place. Even better, generate them offline so there’s no record of them on your device.
- Use a SECURE password manager- and likewise, keep your master password OFFLINE. Change it frequently.
- Be careful about what you download. Even the best antivirus agents can’t catch everything.
