SANS ISC: Atomic macOS (AMOS) Stealer Infection Analysis

Mon, 03 Aug 2026 13:48:19 +0000

Engineer — Learn: AMOS is an active macOS infostealer targeting credentials and sensitive files; the summary is too thin to confirm specifics, so read the full SANS ISC diary for infection chain details and any affected software or configuration indicators relevant to your macOS fleet.
SOC/IR — Plan: AMOS campaigns continue to hit macOS endpoints — review the full SANS ISC diary entry for IOCs and TTPs to build or tune macOS-targeted detections in your EDR and SIEM, particularly around credential-harvesting process behavior.
Leader — Skip

Amos on CuraSec