AMOS stealer is a macOS information stealer malware first advertised in April 2024 and actively evolving as of August 2026. It is distributed through malicious websites that trick users into running terminal commands that download and execute payloads. The infection installs Mach-O binaries and shell scripts in user Library directories, requiring administrative password input and requesting permissions to control Finder, access Desktop and Documents folders, and control the Notes application. It collects data from various applications, including cryptocurrency wallets and messaging apps, compresses the data into an archive, and exfiltrates it via HTTP POST requests to frequently changing C2 servers. Indicators such as domains, IPs, filenames, and hashes change often, indicating ongoing development and evasion efforts. Palo Alto Networks products provide detection capabilities for known indicators.

AMOS stealer compromises macOS systems by stealing sensitive user data including system information, login credentials, browser data, cryptocurrency wallet contents, and messaging data. It requires user interaction to execute and administrative privileges to install. The malware exfiltrates collected data to attacker-controlled servers, potentially leading to credential theft, financial loss, and privacy breaches. The malware's active development and frequent indicator changes complicate detection and response efforts.

No official patch is applicable as this is malware infection rather than a software vulnerability. Mitigation focuses on user education to avoid running untrusted terminal commands and downloading software from unverified sources. Endpoint protection solutions such as Palo Alto Networks Advanced URL Filtering and Advanced DNS Security can identify and block known malicious domains and URLs associated with AMOS stealer. Monitoring for unusual terminal activity and restricting administrative privileges can reduce risk. Users should be cautious of prompts requesting passwords and permissions during terminal operations.