Malware analyst discovered a new version of the Atomic macOS info-stealer (also known as 'AMOS') that comes with a backdoor, to attackers persistent access to compromised systems. The analyzed version of the malware comes with an embedded backdoor, uses of LaunchDaemons to survive reboots on macOS, ID-based victim tracking, and new command-and-control infrastructure. MacPaw's cybersecurity division Moonlock analyzed the backdoor in Atomic malware after a tip from independent researcher g0njxa, a close observer of infostealer activity. The evolution of Atomic malware shows that macOS users are becoming more attractive targets and malicious campaigns aimed at them are increasingly sophisticated. A persistent wrapper script named '.agent' (also hidden) runs '.helper' in a loop as the logged-in user, while a LaunchDaemon (com.finder.helper) installed via AppleScript ensures that '.agent' executes at system startup. Bill Toulas Bill Toulas is a tech writer and infosec news reporter with over a decade of experience working on various online publications, covering open-source, Linux, malware, data breach incidents, and hacks. The backdoor allows the threat actors to execute commands remotely, log key strokes, introduce additional payloads, or explore lateral movement potential. In November 2023, it supported the first-ever expansion of 'ClearFake' campaigns onto macOS, while in September 2024, it was spotted in a large-scale campaign by the cybercrime group' Marko Polo,' who deployed it on Apple computers. Moonlock reports that Atomic has recently shifted from broad distribution channels like cracked software sites, to targeted phishing aimed at cryptocurrency owners, as well as job interview invitations to freelancers. "AMOS malware campaigns have already reached over 120 countries, with the United States, France, Italy, the United Kingdom, and Canada among the most affected," the researchers say. The core backdoor executable is a binary named '.helper,' downloaded and saved in the victim's home directory as a hidden file post-infection, the researchers say.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Mon, 07 Jul 2025 18:25:13 +0000