OSX.AtomStealer
ThreatDown is now the name of the Malwarebytes line of business products. References to Malwarebytes below reflect the amazing technology used to first identify the threat.
Short bio
OSX.AtomStealer is Malwarebytes’ detection name for an information stealer targeting macOS systems otherwise known as Atomic Stealer for OSX.
Type of infection
OSX.AtomStealer comes bundled in a signed app promoted in malvertising campaigns. Once installed the malware looks to steal data from the affected machine and send it to the attacker’s server. The info stealer has a strong focusĀ on crypto assets, capable of harvesting passwords from browsers and Appleās keychain, as well as featuring a file grabber.Ā
Malicious behavior
Once executed, the installer for OSX.AtomStealer will keep displaying prompts for theĀ user’s password in a never ending loop until victims finally give in and fill out the password.
Protection
Malwarebytes for MacĀ detects and removes OSX.VSearch.
Home remediation
Malwarebytes for Mac will detect and remove the components of this malware.
Download and install the latest version of Malwarebytes for Mac.
Click the āScan Nowā button to perform a system scan.
If threats are detected during the scan, a count of detected threats is displayed. More detailed threat information is displayed after the scan completes.
Click āConfirmā to move the detected threats to Quarantaine.
If a restart is required to complete remediation of threats detected during a scan, you will be notified. When a restart is required, please remember to save all work before clicking āRestartā.