Home Cyber Security Atomic Stealer Sends Macs Malware Via False Browser Downloads

Atomic Stealer Sends Macs Malware Via False Browser Downloads

Atomic Stealer Sends Macs Malware Via False Browser Downloads


Atomic Stealer malware advertises itself by way of ClearFake browser updates disguised as Google’s Chrome and Apple’s Safari.

Anti-malware software program supplier Malwarebytes has described a brand new variant of Atomic Stealer (also called AMOS), which is malware focusing on Apple customers. The brand new malware variant, distributed by way of the pretend browser replace supply mechanism ClearFake, advertises itself as updates for Apple’s Safari browser and Google’s Chrome browser. The malware is able to grabbing a consumer’s knowledge and sending it to an attacker’s command and management server.

Jérôme Segura, senior director of menace intelligence at Malwarebytes, famous in his publish concerning the assault that ClearFake is actively being up to date and that its use of sensible contacts specifically makes it “some of the prevalent and harmful social engineering schemes.”

“Faux browser updates have been a standard theme for Home windows customers for years, and but up till now the menace actors didn’t increase onto MacOS in a constant approach,” Segura identified.

Soar to:

Timeline of Atomic Stealer malware

Atomic Stealer was first marketed as a malware supply possibility for menace actors in April 2023. Malwarebytes present in September 2023 that Atomic Stealer was focusing on Mac customers by way of pretend software program updates marketed on Google searches. Atomic Stealer was notably suited to grabbing passwords and Apple keychain codes used for bitcoin wallets. Atomic Stealer may carry bank card data.

Whereas Atomic Stealer had been focusing on Mac customers for a while, ClearFake was traditionally used solely in opposition to Home windows machines. That is outstanding as a result of ClearFake is without doubt one of the first Home windows social campaigns made for Home windows that then expanded to not solely a special geolocation however a special working system. Safety researcher Randy McEoin found ClearFake in August 2023.

Safety researcher Ankit Anubhav identified on Nov. 17 that, whereas ClearFake had been seen focusing on Home windows, the Mac model is a brand new improvement.

How ClearFake poses as Safari and Chrome updates

ClearFake is a sequence of malicious web sites that purport to supply updates for Safari (Determine A) and Chrome (Determine B). Potential victims will see websites posing as reputable browser updates.

Determine A

Fake browser download.
The malicious pretend Safari web page could be recognized as spam as a consequence of its odd spacing and use of older icons. Picture: Malwarebytes

Determine B

Fake browser update.
The pretend Chrome replace web page is extra up to date. Picture: Malwarebytes

Then, the ClearFake rip-off will ship Atomic Stealer. Victims who click on by way of to the false updates will obtain a .dmg file that may steal passwords and extract information.

SEE: Some menace actors have used Apple units for surveillance over the past 12 months, and it’s a development that will proceed, in line with Kaspersky. (TechRepublic) 

Malwarebytes discovered that the next malicious domains are related to this menace:

  • Longlakeweb [dot] com
  • Chalomannoakhali [dot] com
  • Jaminzaidad [dot] cm
  • Royaltrustrbc [dot] com

The AMOS stealer could be recognized utilizing the next indicators:

  • 4cb531bd83a1ebf4061c98f799cdc2922059aff1a49939d427054a556e89f464
  • be634e786d5d01b91f46efd63e8d71f79b423bfb2d23459e5060a9532b4dcc7b

Methods to defend in opposition to this malware menace

Safety admins or IT professionals ought to preserve the next in thoughts to guard staff from ClearFake and Atomic Stealer:

  • Maintain your group’s internet safety instruments updated.
  • Remind staff to not obtain purposes from untrusted websites. Mac customers ought to obtain purposes solely from the Mac App Retailer or company-approved areas.
  • Talk clearly about anticipated browser updates and different utility updates.


Supply hyperlink


Please enter your comment!
Please enter your name here