Atomic macOS Stealer
Proof that Macs get infostealers too. What it takes from an infected computer, how it gets there, and how to check whether your logins ended up in its logs.
- Also called
- AMOS
- Seen since
- 2023
- Runs on
- macOS
- Sold as
- A monthly subscription through Telegram
What Atomic macOS Stealer takes
- Passwords from the macOS Keychain
- Browser passwords, cookies, autofill entries and cards
- Cryptocurrency wallets
- Files from the desktop and documents folders
How it spreads
- Fake installers for popular Mac apps
- Search ads for software that lead to look-alike download sites
- Fake browser update pages
Background
Atomic asks for the Mac’s password with a fake system prompt, which lets it open the Keychain. Many Mac owners assume they are safe from this kind of malware, which is part of why it works.
Checking for your logins
Search your email address, username or company domain on this site. The check covers stealer logs from every family, Atomic macOS Stealer included, and shows how many of your logins are in them, for which sites and where the devices were.
A stealer log doesn’t record which malware made it, so a result won’t say whether it was Atomic macOS Stealer or another stealer. The steps afterwards are the same either way: clean the device, then change passwords from a safe one.
Other infostealers
- RedLine Stealer: For years the most common source of stealer logs on the market.
- Lumma Stealer: The stealer behind the fake “verify you are human” pages.
- Vidar: A long-running stealer, often delivered together with other malware.
- Raccoon Stealer: A low-cost stealer whose alleged operator was arrested in 2022.
- StealC: A newer stealer that borrows from Vidar, Raccoon and RedLine.
The full records are on Seer
This site shows how many stealer log records hold a login and a masked sample of them. Seer, which runs the check, shows every record in full: the saved logins and passwords, the cookies, the infected device and when the log was collected.
Seer also searches breach records and social accounts, so one email address shows everywhere it has leaked and every account it is linked to.
- Stealer log searchFull records from infected devices, by email, username, domain, password or IP address.
- Breached credentialsWhich data breaches an email address or username appears in, and what leaked with it.
- Social account searchThe accounts an email address, username or phone number is linked to across hundreds of sites.
- Plans and pricingA free account to start, and plans for investigators and security teams.