A massive malware campaign targeting macOS users through more than 2,800 compromised websites. The operation deploys Atomic Stealer (AMOS), a sophisticated information-stealing malware specifically designed to extract sensitive data from Apple computers.
The campaign, dubbed “MacReaper” was initially discovered on a compromised Brazilian news site before investigators expanded their search to reveal the true scale of the attack.
BadByte researchers said to Cyber Security News that the malware employs a deceptive technique known as “ClickFix” or “ClearFix” that displays fake Google reCAPTCHA verification prompts only to macOS users.
“This is one of the most sophisticated social engineering campaigns targeting Apple users we’ve seen in 2025,” said cybersecurity expert who discovered the attack.
ClickFix is a tactic that leverages convincing fake interfaces, such as a reCAPTCHA prompt, to trick users into executing malicious commands in their macOS Terminal.
AMOS Stealer Malware Attack MacOS Users
By mimicking trusted web elements and automatically copying obfuscated commands to the user’s clipboard, ClickFix bypasses many conventional browser security features and exploits the natural trust users place in routine online interactions.
“The attackers have gone to extraordinary lengths to make their fake interface look legitimate, even implementing macOS-specific keyboard shortcuts in their instructions,”
The attack begins when users visit a compromised website, where a fake reCAPTCHA interface appears. When victims click “I’m not a robot,” the malware silently copies malicious code to their clipboard and instructs them to open Terminal and paste the command.
This execution downloads and installs Atomic Stealer, which then harvests passwords from Keychain, browser credentials, cryptocurrency wallets, and sensitive documents, the researcher said.
This campaign is particularly dangerous because it uses “EtherHiding,” a technique that stores malicious code on the Binance Smart Chain blockchain to evade detection and resist takedown attempts.
EtherHiding, on the other hand, uses the Binance Smart Chain (BSC) blockchain to host and deliver malicious payloads. By embedding malware-related scripts within smart contracts, attackers take advantage of the blockchain’s decentralized and immutable nature, making it nearly impossible for authorities or security vendors to take down the malicious infrastructure.
The attack specifically targets macOS systems through user-agent detection, ensuring Windows and Linux users remain unaffected.
“AMOS is sold as Malware-as-a-Service on Telegram for up to $3,000 monthly,” notes the report. “Its operators have created an infrastructure capable of stealing vast amounts of sensitive data from thousands of victims.”
Atomic Stealer Key Features
- Keychain Passwords: Extracts credentials stored in the macOS Keychain, which serves as a valuable resource for personal and corporate accounts.
- Browser Data: Collects cookies, passwords, and autofill data from browsers such as Chrome and Firefox.
- Cryptocurrency Wallets: Targets over 50 wallets and extensions, including Binance, Exodus, and Coinomi.
- System Information: Collects hardware UUID, CPU, RAM, and OS details using
system_profiler. - File Exfiltration: Downloads files from the Desktop and Documents folders, often requesting user permission to blend in.
Security experts recommend that macOS users take immediate precautions:
- Never execute Terminal commands prompted by websites
- Use caution with reCAPTCHA prompts that ask for additional actions
- Keep macOS and all applications updated
- Install reputable security software that can detect this threat
Apple’s built-in security features can help protect users when properly configured. Setting System Settings to allow applications only from the App Store provides the highest level of protection against this type of malware.
The discovery highlights the growing sophistication of attacks targeting macOS users, challenging the long-held perception that Apple computers are inherently more secure than other platforms.
Setting Up SOC Team? – Download Free Ultimate SIEM Pricing Guide (PDF) For Your SOC Team -> Free Download
