Stealers on the Rise: A Closer Look at a Growing macOS Threat

This report details a growing wave of macOS infostealers—Atomic (AMOS), Poseidon, and Cthulhu—sold as Malware-as-a-Service and distributed via malvertising, trojanized installers, Google Ads, and spam; it analyzes their AppleScript-based techniques for stealing credentials, browser data, crypto wallets, and notes, provides detection/mitigation guidance (Cortex XDR, XSIAM, WildFire, URL/DNS filtering), and supplies IoCs (SHA256 hashes and C2 IPs) for defenders to act on.