ATOMIC MACOS (AMOS) STEALER INFECTION

11.9.2026  MALWARE TRAFFICS 

NOTICE:

• Zip files are password-protected.  Of note, this site has a new password scheme.  For the password, see the "about" page of this website.

NOTES:

• My thanks to Dani [Varys] Z who let me know abut the fake macOS software page through a comment on LinkedIn.

ASSOCIATED FILES:

• 2026-09-10-AMOS-Stealer-notes.txt.zip   1.9 kB   (1,884 bytes)

• 2026-09-10-AMOS-Stealer-infection-traffic.pcap.zip   3.5 MB   (3,476,742 bytes)

• 2026-09-10-files-from-AMOS-Stealer-infection.zip   838.7 kB   (838,718 bytes)

IMAGES

Shown above: Fake macOS software page.

Shown above: Text from the fake software page pasted into a macOS Terminal window.

Shown above: Traffic from the infection filtered in Wireshark.