Atomic macOS Stealer (often called AMOS) is a commercial infostealer targeting macOS systems. It extracts browser credentials, cookies, cryptocurrency wallets, and system metadata, then exfiltrates them to attacker infrastructure. AMOS challenged the assumption that infostealers are a Windows-only problem.
Recent variants have added backdoor functionality for persistent access, widening the blast radius beyond credential theft. Security teams with macOS fleets should include stealer monitoring in their identity exposure programs alongside traditional EDR coverage.
Read our report on Atomic macOS Stealer's persistent backdoor and macOS-relevant trends in 2026 infostealer monitoring.