🕵️ AMOS

The items that name it 6

• macOS.Gaslight | Rust Backdoor Turns Prompt Injection on the Analyst, Not the Sandbox
  writeup2026-06-23It is written here as Atomic macOS Stealer (AMOS).

  Previously documented by SentinelLABS harvesting login keychain copy and browser data, similar to macOS.Gaslight's collection module

• Deceptive Installers: How Fake Apps Target macOS
  writeup2026-06-10

  macOS infostealer malware family; uses background-image Gatekeeper bypass instructions in deceptive DMG installers

• How Fake OpenClaw Installers Spread GhostSocks Malware
  writeup2026-03-04It is written here as Atomic MacOS Stealer (AMOS).

  macOS information stealer distributed via OpenClawBot Mach-O binary, exfiltrates files from TCC-protected locations and archives with ditto before POSTing to a malicious domain

• AI-Poisoning & AMOS Stealer: The Biggest Mac Threat | Huntress
  writeup2025-12-09It is written here as AMOS (Atomic macOS Stealer).

  macOS infostealer delivered via AI-poisoning campaign; harvests credentials, escalates privileges, deploys persistence; used to steal passwords, browser data, keychain data, and cryptocurrency wallet data. Loader/payload downloaded from C2 hxxps[://]putuartana[.]com/cleangpt (with two additional C2

• OWASP Agentic Skills Top 10 (AST10)
  repo

  Malware delivered by 335 skills sharing a single C2 IP during ClawHavoc campaign.

• OWASP Agentic Skills Top 10
  paper

  Malware family delivered by 335 skills in the ClawHavoc campaign.