AMOS is short for Atomic macOS Stealer, a malware family aimed at Apple computers. It is an infostealer: instead of damaging files, it focuses on quietly collecting valuable data such as browser-saved passwords, session tokens, and cryptocurrency wallet information. That makes it especially useful for account takeover and financial theft.
In real attacks, AMOS is often delivered through social engineering rather than a software exploit. A fake CAPTCHA, update prompt, or help page may persuade a user to copy and run a command in Terminal, giving the malware a path from the browser into native macOS execution. Defenders watch for suspicious paste-and-run behavior, unexpected Terminal launches, and credential theft indicators. User training and endpoint detection are important because the attack depends on trust, not just code vulnerabilities.