Cyber: Amos Infostealer Targets Macos Through A Popular AI App 2026

Infostealers like Atomic MacOS Stealer (AMOS) represent far more than a standalone malware. They are foundational components of a mature cybercrime economy built around harvesting, trading, and operationalizing stolen digital identities.

Rather than acting as the end goal, modern stealers function as large-scale data collection engines that feed underground markets, where stolen credentials, sessions, and financial data are bought and sold to fuel account takeovers, fraud, and follow-on intrusions.

What makes these campaigns particularly effective is their highly opportunistic social engineering approach: attackers continuously adapt to technology trends, abusing trusted platforms, popular software, search engines, and even emerging AI ecosystems to trick users into executing malware themselves.

This combination of industrialized data monetization and adaptive social engineering has made infostealers one of the most reliable and scalable entry points in today’s cybercrime landscape.

In the new 2026 Enterprise Infostealer Identity Exposure report, Flare researchers highlight the growing dominance of infostealers within the cybercrime economy and the expanding impact of identity exposure on organizations.

In this article, we examine the AMOS infostealer as a case study, exploring its evolution, operational model, and real-world activity across its active years.

Infostealers operate as one of the most critical enablers in the modern cybercrime kill chain because they transform a single infection into large-scale credential, session, and identity compromise.

Recent research by Koi security reminded us that AMOS infostealer dissemination techniques are cunningly designed to find weaknesses and exploit every segment of technology users to steal their credentials.

The research describes ClawHavoc as a large-scale supply-chain campaign targeting the OpenClaw and ClawHub ecosystem (A very popular personal AI assistant) by poisoning the skill marketplace itself.

While the specific details are impressive, what matters more is the underlying tactic. AMOS distributors are capitalizing on OpenClaw's popularity as AI-hyped software.

Source: BleepingComputer