Atomic macOS Info-Stealer Updated with New Backdoor for Persistent Access

The Atomic macOS Stealer (AMOS), a notorious piece of info-stealing malware targeting Apple users, has undergone a significant update, introducing an embedded backdoor for the first time.

This development, reported by Moonlock a cybersecurity division of MacPaw marks a critical escalation in the malware’s capabilities, allowing attackers to maintain persistent access to compromised macOS systems.

A Dangerous Evolution in macOS Malware

Unlike its previous focus on data exfiltration from cryptocurrency-related browser extensions and wallets, AMOS now enables remote command execution, full user-level access, and system persistence even after reboots.

This upgrade positions AMOS as one of the most dangerous threats to macOS users, with campaigns already spanning over 120 countries, including the United States, France, Italy, the United Kingdom, and Canada.

The addition of a backdoor transforms AMOS from a one-time data theft tool into a platform for long-term surveillance and exploitation ...