Amos Stealer Targets macOS Keychain Files and Browser Passwords
Amos Stealer malware targets macOS users via fake downloads, stealing passwords and sensitive files.
Amos Stealer, an information-stealing malware, is actively targeting macOS users through deceptive downloads and social engineering. The malware silently collects browser passwords, Keychain files, developer configurations, and session cookies. It utilizes built-in macOS utilities like curl and AppleScript to exfiltrate data, compressing it into an archive before sending it to attacker-controlled servers.
AI summary of the linked source. Not reviewed by an editor. How this works
Run CyberProof?
Get an email when a new story names CyberProof, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonAmos Stealer exploits user trust through deceptive downloads and social engineering to gain a foothold on macOS systems, highlighting the critical risk posed by malware that blends into legitimate user behavior. Once installed, it silently abuses native macOS utilities like curl and AppleScript — tools users and defenders may not flag as suspicious — to harvest and exfiltrate sensitive credentials, Keychain files, and session cookies. This matters because compromised session tokens and Keychain data can lead to full account takeovers across personal and enterprise services without requiring a password. The attack demonstrates that endpoint security cannot rely solely on patch management; user behavior and download hygiene are equally critical layers of defense.
What helps against this
How we list vendors
- Device management (MDM and UEM)
Every company laptop and phone is known, encrypted, locked down and up to date.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Data loss prevention (DLP)
Sensitive data cannot quietly leave by email, upload, USB stick or AI tool.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- domain — bestbuydomain.com
- malware — Amos Stealer