Products & ServicesProducts & Services
SolutionsSolutions
PricingPricing
CompanyCompany
ResourcesResources

AMOS Stealer

Also known as:Atomic StealerAtomic macOS StealerAMOSAtomic Mac

What is the AMOS Stealer infostealer, and what data does it steal?

AMOS Stealer (also known as Atomic Stealer, Atomic macOS Stealer, AMOS and Atomic Mac) is an information-stealing malware family operating under the MaaS model. AMOS Stealer targets browser credentials, cryptocurrency wallets, Telegram session tokens, macOS Keychain database and login password (AppleScript prompt) and Documents and Desktop file grabber (.txt, .pdf, .docx, .wallet, .key). As of 11/10/2026, CyStack's research records 1 variant, with high attribution confidence.

Note: This data is provided for reference and cybersecurity research only.
CyStack recommends that users do not use this information for unlawful purposes

Description

Original English

Atomic macOS Stealer (AMOS) is a Go and C++ macOS info-stealer sold as malware-as-a-service through private Telegram channels since April 2023. The operator panel charges around $1000 per month and ships a builder, a victim web panel, a MetaMask brute-forcer, and Telegram log delivery. Multiple public malware writeups profile the family. AMOS spawned the Banshee, Cthulhu, Poseidon, and Odyssey forks tracked separately in this catalog.

The artifact documented here is the operator-facing summary written as UserInformation.txt inside per-victim folders of AMOS log aggregator packs. The file opens with four flush-left panel section headers in a fixed order (MetaMask Info:, Debanks:, Userinfo:, then Software: / Hardware: / Graphics/Displays: introducing the verbatim system_profiler output for the SPSoftwareDataType, SPHardwareDataType, and SPDisplaysDataType data types). MetaMask Info and Debanks sit empty in most samples because the panel surfaces wallet artifacts in sibling folders (Wallets/, Keychain/) rather than inlined into this summary.

MITRE ATT&CK technique mapping

Data provided by

Accelerate investigation with professional monitoring solutions

Infostealer data represents only a fraction of modern data theft threats. With the Threat Intelligence component in the CyStack VulnScan solution suite, organizations can investigate each threat and credential exposure in depth, mapping C2, IOCs, and other actionable threat intelligence.

Explore Threat Intelligence

Variants (1)

1 variant recorded for this malware

ID	Data collected	Confidence
`93dd740...`	19,149	Medium

Data limited to 5 variants

To see more variants, organizations should use dedicated solutions such as CyStack Threat Intelligence

Explore CyStack Threat Intelligence

Sample log format

1MetaMask Info:2Debanks:3 4Userinfo:5Country: <value>6IP: <value>7City: <value>8Software:9 10System Software Overview:11 12  System Version: <value>13  Kernel Version: <value>14  Boot Volume: <value>15  Boot Mode: <value>16  Computer Name: <value>17  User Name: <value>18  Secure Virtual Memory: <value>19  System Integrity Protection: <value>20  Time since boot: <value>21 22Hardware:23 24Hardware Overview:25 26  Model Name: <value>27  Model Identifier: <value>28  Model Number: <value>29  Chip: <value>30  Total Number of Cores: <value>31  Memory: <value>32  System Firmware Version: <value>33  OS Loader Version: <value>34  Serial Number (system): <value>35  Hardware UUID: <value>36  Provisioning UDID: <value>37  Activation Lock Status: <value>38 39Graphics/Displays:40 41Apple M3 Pro:42 43  Chipset Model: <value>44  Type: <value>45  Bus: <value>46  Total Number of Cores: <value>47  Vendor: <value>48  Metal Support: <value>49  Displays:50BenQ PD3205U:51  Resolution: <value>52  UI Looks like: <value>53  Main Display: <value>54  Mirror: <value>55  Online: <value>56  Rotation: <value>57Color LCD:58  Display Type: <value>59  Resolution: <value>60  Mirror: <value>61  Online: <value>62  Automatically Adjust Brightness: <value>63  Connection Type: <value>64MSI MD241P:65…

AMOS Stealer Malware Analysis: Targets & TTPs