Reported by 2 outlets
Atomic macOS (AMOS) Stealer infection campaign observed
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.00 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Analysis
The Atomic macOS (AMOS) stealer campaign continues with infections delivered via malicious ads impersonating Claude Code, targeting Mac developers. Reports from Malware-Traffic-Analysis and the recent French-language update describe the same infection chain: a fake setup guide that installs AMOS to steal credentials and sensitive data. No new CVEs are tied; the threat remains operational. Watch for expanded delivery vectors or new targets beyond developer audiences.
Timeline
-
original reporting
2026-09-10: Atomic macOS (AMOS) Stealer infection
malware.news · 33d ago · September 10th, 2026
Article Link: Malware-Traffic-Analysis.net - 2026-09-10: Atomic macOS (AMOS) Stealer infection
-
update from unit42.paloaltonetworks.com
Atomic macOS (AMOS) Stealer Activity
unit42.paloaltonetworks.com · 27d ago · September 16th, 2026
Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42 .
-
mentioned by malware.news
2026-10-02: Atomic macOS (AMOS) Stealer infection from malicious ad impersonating Claude Code
malware.news · 9d ago · October 5th, 2026
-
update from malware.news
A macOS stealer distributed via a malicious ad impersonating Claude Code
malware.news · 9d ago · October 5th, 2026
A macOS stealer distributed via a malicious ad impersonating Claude Code. The vector is classic, but the target is interesting: developers.