Hackers selling malware targeting Mac users on Telegram: Report

What is worrying is the fact that hackers behind this malware are constantly improving and adding new capabilities to it. According to the report, the recent update of the malware was seen in a Telegram post on April 25.

It says that the Atomic macOS Stealer can steal various types of information from the victim’s machine, including keychain passwords, complete system information, files from the desktop and documents folder, and even the macOS password. 

“The stealer is designed to target multiple browsers and can extract auto-fills, passwords, cookies, wallets, and credit card information. Specifically, AMOS can target crypto wallets such as Electrum, Binance, Exodus, Atomic, and Coinomi,” it further adds.

The threat actor, the report says, also provides additional services such as a web panel for managing victims, meta mask brute-forcing for stealing seed and private keys, crypto checker, and dmg installer, via Telegram. These services are offered at a price of $1000 per month.

As per the CRIL report, Apple Mac users are advised to install a .dmg file on their laptops and computers to protect them from AMOS malware. After installing, users can authenticate the installation with a user password with a fake system dialog box following installation. On installing the file, it will scan for sensitive information, which it will steal with the system password if necessary, and send to a remote server.

What should Mac users do?

Apple mac users are advised to practice general precautions like visiting reliable and reputable websites. They can also download real time malware blocking tools.