Atomic Stealer Gets an Upgrade – Targeting Mac Users with Encrypted Payload

Cybersecurity scientists have determined an current edition of a macOS details stealer termed Atomic (or AMOS), indicating that the danger actors driving the malware are actively enhancing its capabilities.

“It appears like Atomic Stealer was updated all-around mid to late December 2023, wherever its builders introduced payload encryption in an exertion to bypass detection guidelines,” Malwarebytes’ Jérôme Segura reported in a Wednesday report.

Atomic Stealer 1st emerged in April 2023 for a monthly subscription of $1,000. It is able of harvesting sensitive details from a compromised host, like Keychain passwords, session cookies, files, crypto wallets, process metadata, and the machine’s password via a faux prompt.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

Around the previous several months, the malware has been noticed propagated by using malvertising and compromised web-sites underneath the guise of authentic computer software and web browser updates.

Malwarebytes’ most recent analysis demonstrates that Atomic Stealer is now currently being bought for a significant $3,000/thirty day period rental payment, with the actors operating a promotion coinciding with Xmas, providing the malware for a discounted cost of $2,000.

Aside from incorporating encryption to thwart detection by security program, strategies distributing Atomic Stealer have gone through a slight change, wherein Google lookup adverts impersonating Slack are utilised as conduits to deploy Atomic Stealer or a malware loader termed EugenLoader (aka FakeBat) dependent on the running system.

It can be value noting that a malvertising marketing campaign spotted in September 2023 leveraged a fraudulent internet site for the TradingView charting platform to deliver NetSupport RAT, if frequented from Windows, and Atomic Stealer, if the operating process is macOS.

The rogue Slack disk image (DMG) file, upon opening, prompts the target to enter their system password, therefore allowing for risk actors to acquire sensitive information and facts that are access-limited. Yet another important element of the new version is the use of obfuscation to conceal the command-and-regulate server that receives the stolen info.

“As stealers carry on to be a best menace for Mac consumers, it is crucial to down load software from trustworthy spots,” Segura explained. “Destructive adverts and decoy web pages can be really deceptive though and it only can take a single slip-up (getting into your password) for the malware to obtain and exfiltrate your facts.”

Identified this short article interesting? Stick to us on Twitter  and LinkedIn to study more exclusive material we put up.