Atomic macOS: The Stealer That Arrives as a Terminal Paste
SANS ISC documented an Atomic macOS (AMOS) stealer infection spread by a fake "macOS toolkit" web page that tells you to paste a command into Terminal. Breaking down the infection chain, the macOS-specific delivery habits it exploits, and what to check.
The Atomic macOS (AMOS) stealer — a malware-as-a-service infostealer targeting macOS — is being distributed by telling users to copy and paste a “toolkit” command into their Terminal. According to a SANS ISC diary entry published on August 2, 2026, by Brad Duncan, the campaign uses a web page from getmacouscloud[.]com that instructs visitors to paste text into a macOS Terminal window, supposedly as part of a “macOS toolkit.” In reality, that text is a command that retrieves and installs the AMOS stealer.
The infection chain
The attack begins with traffic to macostruecloud.xyz and getmacouscloud.com. The pasted command downloads an initial zsh script (SHA-256 b9ec3261..., 1,973 bytes). That script base64-decodes to a gzip archive, which yields a second zsh script (SHA-256 13b868b3..., 1,227 bytes).
The second script downloads a Mach-O universal binary (supporting both x86_64 and arm64) as a helper at /tmp/helper (SHA-256 9f25ec53..., 297,952 bytes). It also places persistent copies under:
Library/Application Support/.com.apple.accountsd/AccountsHelper(SHA-2560a03cf18..., 438,656 bytes)Library/Application Support/.com.apple.metadata.mds/mdworker_shared(SHA-25601a0d5332..., 503,152 bytes)
These persistence paths mimic legitimate Apple daemon locations — an example of security through misdirection.
Command-and-control staging
The AMOS malware stages over TCP/80 via HTTP POST to 188.166.78.138, using event=stage parameters with stages including:
started/bootinit_sessionmessengerscredentialsbrowserswalletsresolve_authlocal_data
Additional API endpoints observed include /api/join, /api/bots/device-info, /api/tasks/ack, and /api/feed/register.
What AMOS targets
AMOS is a known malware-as-a-service stealer. It exfiltrates passwords, cookies, browser data, crypto wallets, messengers, and keychain contents. In this campaign, the lure abuses the well-known macOS habit of copy-pasting cryptic commands into Terminal, and it relies on the user entering their password to escalate privileges.