---
title: Atomic Stealer Evolves
description: The Atomic macOS Stealer (AMOS) has evolved with a new backdoor, enabling persistent access and remote command execution on compromised macOS systems.
---

[Insights, news, education and announcements from PolySwarm](https://blog.polyswarm.io)

# [Atomic Stealer Evolves](https://blog.polyswarm.io/atomic-stealer-evolves)

 Written by [The Hivemind](https://blog.polyswarm.io/author/the-hivemind) | Jul 25, 2025 6:47:25 PM

**Verticals Targeted:** Cryptocurrency, Freelancers, Artists  
**Regions Targeted:** United States, France, Italy, United Kingdom, Canada, others  
**Related Families:** None

## **Executive Summary**

## The Atomic macOS Stealer (AMOS) has evolved with a new backdoor, enabling persistent access and remote command execution on compromised macOS systems. This escalation transforms AMOS into a significant threat, targeting individuals and requiring robust defenses to mitigate risks.

**Key Takeaways**

- AMOS now includes a backdoor for persistent access, surviving reboots and enabling remote task execution.  
- Distribution leverages spear phishing and cracked software, targeting cryptocurrency owners and freelancers.  
- Campaigns have impacted over 120 countries, with notable activity in the U.S., U.K., France, Italy, and Canada.  
- The backdoor uses LaunchDaemons and hidden files to maintain persistence and evade detection.

**What is Atomic Stealer?**

### The Atomic macOS Stealer (AMOS), a prominent infostealer targeting Apple’s macOS ecosystem, has undergone a significant transformation, integrating a persistent backdoor that elevates its threat profile. Previously known for extracting sensitive data such as cryptocurrency wallet credentials and browser data, AMOS now enables attackers to maintain long-term control over compromised systems, execute remote commands, and potentially deploy additional payloads. This development, [reported](https://moonlock.com/amos-backdoor-persistent-access) by Moonlock Lab, the cybersecurity division of MacPaw, marks a critical shift from one-time data theft to sustained system compromise, positioning AMOS as a formidable threat to macOS users globally.

AMOS campaigns have already impacted over 120 countries, with the United States, France, Italy, the United Kingdom, and Canada among the most affected regions. The malware’s distribution primarily relies on two vectors: websites offering cracked or counterfeit software and sophisticated spear-phishing campaigns targeting individuals, particularly cryptocurrency holders and freelancers such as artists. These phishing attacks often masquerade as job interview processes, tricking victims into installing trojanized DMG files by requesting system passwords under the pretext of enabling screen-sharing software. Once executed, AMOS extracts sensitive data, including passwords and seed phrases, while deploying a backdoor for ongoing access.

The backdoor’s technical implementation enhances AMOS’s persistence and stealth. It deploys a binary named \`.helper\`, stored as a hidden file in the victim’s home directory, and a wrapper script called \`.agent\` that ensures continuous execution. A LaunchDaemon, labeled \`com.finder.helper\`, is installed via AppleScript to guarantee the backdoor runs at system startup, leveraging stolen user credentials for elevated privileges. The backdoor communicates with command-and-control (C2) servers using HTTP POST requests every 60 seconds to receive tasks. To evade detection, AMOS employs string obfuscation and checks for sandbox or virtual machine environments using the \`system\_profiler\` command, ensuring it remains covert during analysis.

This upgrade aligns AMOS with tactics previously observed in North Korean campaigns, which combine stealers with backdoors for rapid data exfiltration. However, AMOS’s Russia-affiliated developers appear focused on long-term persistence, enabling surveillance, keylogging, and potential lateral movement within networks. The malware-as-a-service (MaaS) model suggests further enhancements, with reports indicating potential keylogging features in development. 

The implications for macOS users are profound, as AMOS transcends traditional infostealer limitations, posing risks of prolonged compromise. As AMOS continues to evolve, proactive awareness and advanced endpoint protection are critical to safeguarding macOS environments against this persistent and escalating threat. PolySwarm analysts consider Atomic Stealer to be an evolving threat. 

**IOCs**

PolySwarm has multiple samples of Atomic Stealer.

 

[8d8b40e87d3011de5b33103df2ed4ec81458b2a2f8807fbb7ffdbc351c7c7b5e](https://polyswarm.network/scan/results/file/8d8b40e87d3011de5b33103df2ed4ec81458b2a2f8807fbb7ffdbc351c7c7b5e)

[3402883ff6efadf0cc8b7434a0530fb769de5549b0e9510dfdd23bc0689670d6](https://polyswarm.network/scan/results/file/3402883ff6efadf0cc8b7434a0530fb769de5549b0e9510dfdd23bc0689670d6)

[f4976d9a90d2f9868fcaade1449ffcf9982ed2285ace90aafa7099ce246fd2ec](https://polyswarm.network/scan/results/file/f4976d9a90d2f9868fcaade1449ffcf9982ed2285ace90aafa7099ce246fd2ec)

[54b9576aad25d54d703adb9a26feaa5d80f44b94731ff8ecff7cf1ebc15cf3ff](https://polyswarm.network/scan/results/file/54b9576aad25d54d703adb9a26feaa5d80f44b94731ff8ecff7cf1ebc15cf3ff)

[11e55fa23f0303ae949f1f1d7766b79faf0eb77bccb6f976f519a29fe51ce838](https://polyswarm.network/scan/results/file/11e55fa23f0303ae949f1f1d7766b79faf0eb77bccb6f976f519a29fe51ce838)

[ec11fd865c2f502c47f100131f699a5e0589092e722a0820e96bd698364eefdb](https://polyswarm.network/scan/results/file/ec11fd865c2f502c47f100131f699a5e0589092e722a0820e96bd698364eefdb)

 

You can use the following CLI command to search for all Atomic Stealer samples in our portal:

**$ polyswarm link list -f AtomicStealer**

 

***Don’t have a PolySwarm account? Go* [here](https://polyswarm.network/) *to sign up for a free Community plan or subscribe.***

***Contact us at* [hivemind@polyswarm.io](mailto:hivemind@polyswarm.io) *| Check out our* [blog](https://blog.polyswarm.io/) ***|* **[Subscribe](https://polyswarm.io/ransomwarereport/) *to our reports.***

 

[View full post](https://blog.polyswarm.io/atomic-stealer-evolves)

```json
{
  "@context" : "http://schema.org",
  "@type" : "BlogPosting",
  "author" : {
    "@type" : "Person",
    "name" : "The Hivemind"
  },
  "dateModified" : "2025-07-25T18:47:25.374Z",
  "datePublished" : "2025-07-25T18:47:25Z",
  "headline" : "Atomic Stealer Evolves",
  "image" : {
    "@type" : "ImageObject",
    "height" : 900,
    "url" : "https://5737925.fs1.hubspotusercontent-na1.net/hubfs/5737925/Threat%20Bulletin%20Images/ATOMICSTEALER.jpg",
    "width" : 1600
  },
  "mainEntityOfPage" : "https://blog.polyswarm.io/atomic-stealer-evolves",
  "publisher" : {
    "@type" : "Organization",
    "logo" : {
      "@type" : "ImageObject",
      "height" : 60.0,
      "url" : "https://cdn2.hubspot.net/hubfs/5737925/Social%20Icons_PS-1.png",
      "width" : 59.820896
    },
    "name" : "The PolySwarm Blog"
  }
}
```