# Unit 42

Published articles for Unit 42.

This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles.

## Atomic macOS (AMOS) Stealer Activity

DevFeed: [Atomic macOS (AMOS) Stealer Activity](<https://devfeed.tech/articles/atomic-macos-amos-stealer-activity-30906.md>)

Original publisher: [Read original article](<https://unit42.paloaltonetworks.com/atomic-macos-amos-stealer-activity/>)

Author: Bradley Duncan

Published: 2026-09-16T10:00:06Z

Content type: article

Language: en

Sources: [Unit 42](<https://devfeed.tech/sources/unit-42.md>)

Topics: [Malware](<https://devfeed.tech/topics/malware.md>), [Aeternum](<https://devfeed.tech/topics/aeternum.md>), [macOS](<https://devfeed.tech/topics/macos.md>), [sensitive data](<https://devfeed.tech/topics/sensitive-data.md>), [Zsh](<https://devfeed.tech/topics/zsh.md>), [ClickFix](<https://devfeed.tech/topics/clickfix.md>), [cURL](<https://devfeed.tech/topics/curl.md>)

Tags: [ads](<https://devfeed.tech/tags/ads.md>), [clickfix](<https://devfeed.tech/tags/clickfix.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cryptocurrency](<https://devfeed.tech/tags/cryptocurrency.md>), [curl](<https://devfeed.tech/tags/curl.md>), [general](<https://devfeed.tech/tags/general.md>), [insights](<https://devfeed.tech/tags/insights.md>), [macos](<https://devfeed.tech/tags/macos.md>), [malware](<https://devfeed.tech/tags/malware.md>), [sensitive-data](<https://devfeed.tech/tags/sensitive-data.md>), [threat-intelligence](<https://devfeed.tech/tags/threat-intelligence.md>), [unit-42](<https://devfeed.tech/tags/unit-42.md>), [zsh](<https://devfeed.tech/tags/zsh.md>)

### AI overview

This article analyzes a laboratory-generated Atomic macOS (AMOS) stealer infection observed on Aug. 5, 2026. It describes a deceptive macOS toolkit installation page that led users to paste a command into Terminal, retrieving a Zsh script containing an encoded compressed payload and a follow-up script designed to run a Mach-O binary. AMOS targets macOS and can exfiltrate system information, login credentials, and sensitive data from applications including browsers and cryptocurrency wallets.

### Source excerpt

Modern macOS malware uses deceptive setup guides to steal credentials and sensitive user data. Learn how to identify and block these threats. The post Atomic macOS (AMOS) Stealer Activity appeared first on Unit 42.