macOS Malware Campaign Uses Cracked Apps to Bypass Apple’s Security Defense

A sophisticated malware campaign is targeting macOS users by disguising the Atomic macOS Stealer (AMOS) as cracked versions of popular software, exploiting Apple’s latest security measures. As uncovered by Trend Micro and reported on [techguideonline.com], this attack showcases cybercriminals’ adaptability in evading macOS Sequoia’s enhanced Gatekeeper protections. With sensitive data like credentials and cryptocurrency wallets at risk, macOS users must stay vigilant to protect their systems from these deceptive lures.

The Rise of AMOS Malware in macOS Attacks

The Atomic macOS Stealer (AMOS) has emerged as a potent threat, designed to infiltrate systems and extract a wide range of sensitive information. Trend Micro’s September 4, 2025, report highlights how attackers are distributing AMOS through fake cracked apps, bypassing traditional .dmg-based infection methods blocked by Apple’s Gatekeeper. This shift to terminal-based installations marks a significant evolution in tactics, as noted by cybersecurity expert Kevin Beaumont on X: “AMOS malware now uses cracked app lures to sidestep macOS security. It’s a clever pivot to terminal commands.”

Victims are often lured via social engineering, downloading malicious installers from sites like haxmac[.]cc, which hosts pirated software. In one case, users searching for “CleanMyMac” fell prey to AMOS, which then stole credentials, browser data, cryptocurrency wallets, Telegram chats, VPN profiles, Apple Notes, and files from common folders. This broad data theft capability makes AMOS particularly dangerous, as it targets both personal and professional assets.

How the AMOS Attack Chain Works

The campaign begins with users seeking free versions of premium software, a common tactic exploited by cybercriminals. Here’s how the attack unfolds:

Initial Access via Cracked Software

Attackers host malicious versions of popular apps on sites like haxmac[.]cc, enticing users to download .dmg files or execute terminal commands mimicking legitimate installations. These commands, resembling fake CAPTCHA prompts, trick users into granting permissions that bypass Gatekeeper, Apple’s built-in security feature. Trend Micro noted that this terminal-based approach effectively circumvents Sequoia’s protections, which block traditional .dmg infections.

A post by The Cyber Security Hub on X emphasized, “macOS users beware: AMOS campaign uses cracked apps to bypass Apple’s Gatekeeper, stealing everything from crypto wallets to keychain data.” This highlights the campaign’s deceptive simplicity.

Malware Deployment and Data Theft

Once installed, AMOS establishes persistence, ensuring it remains active even after system reboots. It then extracts sensitive data, including:

• Browser data from Chrome, Brave, Edge, and others
• Cryptocurrency wallet details
• Keychain items and Apple Notes
• Files from common directories

The stolen data is exfiltrated to attacker-controlled servers, often using encrypted channels to evade detection. For more on macOS malware tactics, check out Trend Micro’s detailed analysis: An MDR Analysis of the AMOS Stealer Campaign.

A Growing Threat to macOS Users

This campaign reflects a broader trend of increasing macOS-targeted malware. Unlike the Banshee Stealer, which used unique encryption to evade antivirus detection, AMOS focuses on social engineering and persistence, as noted in a Cybersecurity News report: New Banshee Malware Targets macOS Users. Similarly, a July 2025 AMOS upgrade added backdoor capabilities, enabling long-term system control, according to Moonlock’s findings.

Cybersecurity researcher Jake Williams warned on X, “macOS isn’t the safe haven it once was. AMOS’s cracked app lures show attackers are getting smarter.” This shift underscores macOS’s growing appeal to cybercriminals as its enterprise adoption rises.

How to Protect Your macOS Device

To counter AMOS and similar threats, users and organizations should adopt robust security practices:

• Avoid Cracked Software: Only download apps from trusted sources like the Mac App Store or official developer websites.
• Verify Terminal Commands: Be cautious of unsolicited prompts to run terminal commands, especially those resembling CAPTCHA verifications.
• Enable Gatekeeper: Ensure macOS Gatekeeper is active to block unauthorized apps, and keep your system updated.
• Use Antivirus Software: Deploy tools like XProtect or third-party solutions to detect malware early.
• Monitor Network Activity: Check for unusual outbound connections that may indicate data exfiltration.

For additional tips, Bleeping Computer offers a guide on macOS security: How to Protect Your Mac from Malware.

FAQs

What is the Atomic macOS Stealer (AMOS)?

AMOS is a malware targeting macOS users, designed to steal credentials, browser data, cryptocurrency wallets, and other sensitive information via cracked app lures.

How does the AMOS campaign bypass macOS security?

It uses social engineering to trick users into downloading malicious .dmg files or running terminal commands, bypassing Gatekeeper’s protections.

What data is at risk from AMOS malware?

AMOS can steal browser data, cryptocurrency wallets, VPN profiles, Apple Notes, keychain items, and files from common folders.

How can I protect my Mac from cracked app malware?

Avoid pirated software, verify terminal commands, keep Gatekeeper enabled, use antivirus tools, and monitor network activity for suspicious behavior.

Are macOS devices becoming bigger targets for malware?

Yes, as macOS adoption grows in enterprises, attackers like AMOS and Banshee increasingly target it, exploiting user trust and system vulnerabilities.

Stay Safe in the macOS Ecosystem

The AMOS campaign reveals how cybercriminals exploit user trust and macOS’s evolving security landscape. By sticking to verified software and staying informed, you can safeguard your data.