OSX.AtomStealer

Short bio

OSX.AtomStealer is Malwarebytes’ detection name for an information stealer targeting macOS systems otherwise known as Atomic Stealer for OSX.

Symptoms

Once executed, the installer for OSX.AtomStealer will keep displaying prompts for the user’s password in a never ending loop until victims finally give in and fill out the password.

Source and type of infection

OSX.AtomStealer comes bundled in a signed app promoted in malvertising campaigns. Once installed the malware looks to steal data from the affected machine and send it to the attacker’s server. The info stealer has a strong focus on crypto assets, capable of harvesting passwords from browsers and Apple’s keychain, as well as featuring a file grabber. 

Protection

Malwarebytes for Mac detects and removes OSX.VSearch.

Remediation

Malwarebytes for Mac will detect and remove the components of this malware.

Download and install the latest version of Malwarebytes for Mac.

Click the “Scan Now” button to perform a system scan.

If threats are detected during the scan, a count of detected threats is displayed. More detailed threat information is displayed after the scan completes.

Click “Confirm” to move the detected threats to Quarantaine.

If a restart is required to complete remediation of threats detected during a scan, you will be notified. When a restart is required, please remember to save all work before clicking “Restart”.