An updated variant of the Atomic Stealer malware is targeting Mac users, capable of stealing sensitive information such as keychain passwords, local files, browser cookies, credit card details, and cryptocurrency assets. This malware can establish a backdoor on compromised Macs, making them vulnerable to further attacks. It operates on a malware-as-a-service model, allowing cybercriminals to subscribe for a monthly fee. The malware includes a hidden backdoor executable named ‘.helper’ and a persistent wrapper script ‘.agent’, which executes continuously and is activated each time the infected Mac is powered on. The primary distribution channels for this malware are cracked software and spear phishing campaigns. Users are advised to avoid unauthorized software downloads and minimize personal information shared online to reduce the risk of infection. Additional antivirus solutions are recommended for enhanced protection against sophisticated threats.