#ParsedReport #CompletenessMedium
17-09-2026

Atomic macOS (AMOS) Stealer Activity

https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/

Report completeness: Medium

Threats:
Amos_stealer
Clickfix_technique

Victims:
Macos users

ChatGPT TTPs:
do not use without manual check
T1036, T1059.004, T1071.001, T1082, T1105, T1119, T1204

IOCs:
Domain: 1
Url: 4
File: 1
IP: 2
Hash: 5
Email: 0
BrowserExtension: 0

Soft:
macOS, Telegram

Algorithms:
sha256, gzip, base64

Platforms:
apple, arm

Links:
https://github.com/PaloAltoNetworks/Unit42-timely-threat-intel/blob/b97ba6bd934e806421224e2bacd512ef70725145/2026-06-20-ClickFix-campaign-delivers-macOS-infostealer-via-DMG.txt#L22