Atomic macOS Stealer Adds Persistent Backdoor, Threatening Thousands of Macs
A new variant of the Atomic macOS infostealer (AMOS) now ships a hidden backdoor that survives reboots and lets attackers run arbitrary commands on infected Macs. The backdoor, delivered via a hidden helper binary and a LaunchDaemon, could give threat actors persistent control over thousands of macOS devices, especially those handling cryptocurrency.