Fake Microsoft Teams for Mac delivers Atomic Stealer

Malwarebytes describes an active malvertising campaign that lures macOS users with a fake Microsoft Teams ad to download a malicious DMG that installs Atomic Stealer (OSX.AtomStealer). The campaign uses profiling, cloaking domains, unique per-victim payloads, and instructions to bypass macOS unsigned-app protections to harvest keychain passwords and files, then exfiltrates encoded data to a remote C2 (147.45.43.136); indicators and mitigations are provided.