In this post, we discuss a significant threat to your Mac computers: MacStealer and Atomic macOS Stealer malware. You can help defend your valuable data and personal information from these digital villains with the right information.
What are MacStealer and Atomic macOS Stealer?
These two malware families were reported in 2023 and specifically target macOS systems, stealing passwords, credit card information, and various files from infected Macs. See Uptycs’ MacStealer analysis and Cyble’s AMOS research, which dates its discovery to April 2023. Compatibility depends on the malware version: the original MacStealer report described Catalina and later systems on Intel and Apple silicon, while AMOS samples analyzed by Unit 42 in August 2026 contained both Intel and ARM64 code. These findings are not a guarantee that every variant runs on every macOS release.
How do they work?
MacStealer and Atomic macOS Stealer target credentials and browser cookies. Uptycs documented MacStealer collecting passwords, cookies, and credit card data from Firefox, Google Chrome, and Brave, along with files and a copy of the Keychain database. Its sample also displayed a fake password prompt. Copying the database should not be confused with demonstrating that every stored password has been decrypted. Uptycs’ technical analysis describes these capabilities; Apple explains Keychain storage and access protections.
The stolen data does not necessarily travel directly through Telegram. Uptycs observed MacStealer uploading an archive to an attacker-controlled server, which then forwarded it to a Telegram bot. In a separate AMOS infection studied in August 2026, Unit 42 observed data sent to a command-and-control server using HTTP POST requests. That infection began with a website persuading the user to paste malicious instructions into Terminal. See the MacStealer report and Unit 42’s dated AMOS analysis.
How can I protect myself?
- Keep your macOS up to date: Install available macOS security updates and keep your applications updated. Enable automatic updates where possible, as recommended in CISA’s online safety guidance.
- Only download from trusted sources: Use the Mac App Store or a developer’s verified official website. Do not bypass security warnings simply because an installer tells you to. Apple explains how Gatekeeper checks downloaded apps and what its warnings mean.
- Use antivirus and internet security software thoughtfully: macOS already includes XProtect for detecting and removing malware, with updates delivered automatically. Consider reputable additional security software as another layer of protection, not a substitute for safe habits. Read Apple’s explanation of its built-in malware defenses.
- Use diverse passwords and multi-factor authentication: Choose long, random passwords that are unique to each account, use a password manager, and enable multi-factor authentication wherever possible. CISA recommends these practices.
- Be cautious with email links and attachments: Think twice before opening unexpected links or attachments, especially messages asking for personal information. Review CISA’s phishing advice.
- Watch out for unexpected password prompts: Be suspicious when an unfamiliar app asks for your Mac login password. Do not rely on appearance alone: Uptycs documented MacStealer displaying a fake system-style prompt. See the original analysis.
- Do not paste unfamiliar commands into Terminal: Treat website, chat, or email instructions to run commands as a warning sign, even when they claim to install software or fix a problem. Do not run a command unless you understand it and trust its source. Apple explains alerts for suspicious command pastes and malicious scripts.
By following these simple steps, you can reduce your risk from the ever-evolving threats in the digital world, though no checklist guarantees complete protection. Stay vigilant and stay protected!