Shamos macOS infostealer by COOKIE SPIDER targets Keychain and Notes

A new Mac-focused infostealer malware, named Shamos, is circulating through ClickFix-style attacks and appears to be a variant of the Atomic macOS Stealer AMOS. Developed by a cybercriminal group known as COOKIE SPIDER, Shamos targets data stored in web browsers, the Keychain, Apple Notes and cryptocurrency wallets. Since June 2025, security researchers have flagged infections in more than 300 monitored environments worldwide, signaling a broad and ongoing campaign.

The delivery chain centers on malvertising and deceptive GitHub repositories. Users looking for routine macOS fixes encounter ads and pages that impersonate legitimate help sites, such as macsafer.com and rescuemac.com. They are prompted to copy and paste a one-line command into the Terminal, a tactic designed to bypass Gatekeeper protections. Executing the command triggers the download of a Bash script, which first captures the user’s password and then fetches the SHAMOS payload. The script then prepares and executes the Mach-O executable, removing quarantine flags and setting execute permissions to avoid security checks.

Once active, Shamos performs anti-analysis checks to determine if it is running in a sandbox....