{"type":"rich","version":"1.0","provider_name":"Transistor","provider_url":"https://transistor.fm","author_name":"Daily Security Review","title":"The Evolution of Atomic macOS Stealer: Backdoors, Keyloggers, and Persistent Threats","html":"","width":"100%","height":180,"duration":2700,"description":"This episode exposes the growing menace of Atomic macOS Stealer (AMOS) — a rapidly evolving malware-as-a-service (MaaS) platform targeting macOS users worldwide. Once seen as a simple data stealer, AMOS has matured into a potent, long-term threat featuring keyloggers, a persistent backdoor, and system-level access, all designed to exfiltrate data and maintain control over compromised systems.\nAMOS now enables threat actors to remotely execute commands, spy on users, and re-infect devices even after reboot, thanks to advanced macOS persistence techniques like LaunchDaemons and hidden binary scripts. Its infection chain relies on social engineering, counterfeit applications, and tampered DMG installers — making even savvy Mac users vulnerable.\nThis episode explores:\nAMOS's evolution from stealer to full-platform malware with persistent remote access\nKey features of the latest version, including a keylogger and embedded backdoor capable of running arbitrary commands\nReal-world attack vectors, such as phishing campaigns, cracked software, poisoned torrents, and fake job ads targeting cryptocurrency holders and freelancers\nThe use of macOS persistence mechanisms (LaunchDaemons, osascript, ScriptMonitor) and Gatekeeper evasion\nCross-platform development in GoLang, allowing the malware to operate seamlessly across Mac architectures\nThe global impact, with campaigns spanning over 120 countries and rising infection rates in the U.S., U.K., France, and Canada\nHow AMOS compares to Cthulhu Stealer and North Korea-aligned tools like RustBucket and macOS BeaverTail\nPractical security steps to detect and mitigate AMOS, including IOC monitoring, digital signature verification, and behavioral endpoint defenses\nAMOS has rapidly become one of the top three most detected macOS threats, signaling a paradigm shift in Mac-targeted malware. With crypto wallets, browser data, and personal credentials at risk, this episode is essential listening for anyone in cybersecurity, IT, or using...","thumbnail_url":"https://img.transistorcdn.com/pL79_MJFeJHamQ_ztImsGmDSMdl27VMk_30TAkieujE/rs:fill:0:0:1/w:400/h:400/q:60/mb:500000/aHR0cHM6Ly9pbWct/dXBsb2FkLXByb2R1/Y3Rpb24udHJhbnNp/c3Rvci5mbS8yNzg5/ZjlhNzM5Y2M4Njli/NjkxNzgyODA2Nzhi/MDI2ZC5wbmc.webp","thumbnail_width":300,"thumbnail_height":300}