Adrian Johnson
TLDR:
- Cybersecurity researchers have discovered an upgraded version of the macOS information stealer, Atomic Stealer, indicating that the threat actors behind the malware are actively enhancing its capabilities.
- The latest version of Atomic Stealer introduces payload encryption to bypass detection rules and is being sold for a monthly rental fee of $3,000, with a promotional discount of $2,000 during Christmas.
- Atomic Stealer is distributed through malvertising and compromised sites, with recent campaigns using Google search ads impersonating Slack to deliver the malware.
- The updated version of Atomic Stealer uses obfuscation techniques to conceal the command-and-control server that receives stolen information, making it more difficult to detect and stop.
Cybersecurity researchers have identified an updated version of the macOS information stealer called Atomic (or AMOS). The new version incorporates payload encryption to bypass detection rules, showing that the malware’s developers are actively enhancing its capabilities. Atomic Stealer first emerged in April 2023 and is capable of harvesting sensitive information from compromised hosts, including passwords, session cookies, files, crypto wallets, system metadata, and machine passwords. The malware has been observed being distributed through malvertising and compromised sites. The latest analysis from Malwarebytes shows that Atomic Stealer is now being sold for a hefty monthly rental fee of $3,000, with a promotional discount of $2,000 during Christmas.
One significant change in the distribution strategy is the use of Google search ads impersonating Slack as conduits to deploy Atomic Stealer or a malware loader called EugenLoader, depending on the operating system. Previous campaigns have leveraged fraudulent sites to deliver the malware, with a malvertising campaign in September 2023 using a fake site for the TradingView charting platform to deliver Atomic Stealer to macOS users. The new version of Atomic Stealer also uses obfuscation techniques to conceal the command-and-control server that receives stolen information, making it more difficult to detect and stop.
Cybersecurity experts recommend downloading software from trusted sources and being cautious of malicious ads and decoy sites, as a single mistake such as entering a password can lead to malware collecting and exfiltrating data. The upgrade and ongoing evolution of Atomic Stealer highlight the importance of staying vigilant and taking precautions to protect against cyber threats targeting Mac users.
