Atomic Stealer malware uses fake Chrome and Safari update page to steal passwords and credit card information

Atomic Stealer, a malware that steals sensitive information like passwords and credit card numbers from Windows machines is now targeting macOS users as well. Here's how to stay safe.

By: Tech Desk
New Delhi | Updated: November 28, 2023 04:08 PM IST

2 min read

Atomic Stealer | What is Atomic Stealer | Atomic Stealer Windows macos

Atomic Stealer remains undetected by almost half the anti-virus engines on VirusTotal. (Image Source: Unsplash)

Listen to this article

Your browser does not support the audio element.

Earlier this year, researchers discovered a new malware named ‘Atomic Stealer’ that tricks users into installing it by showing users a fake Chrome update web page asking them to update to the latest version of the browser if they want to see the content on the website.

The malware worked by exploiting vulnerabilities and compromising websites using JavaScrip instructions. In October, the malware was spotted using Binance’s Smart Chain contracts blockchain technology to hide its scripts and infected Windows-powered machines via a campaign named ‘ClearFake’.

Now, a recent post on a website called Infosec Exchange by cybersecurity researcher Ankit Anubhav suggests that the ‘Clearfake’ campaign is now affecting users on macOS as well. A few days later, the news was confirmed by the known cybersecurity company Malwarebytes.

Atomic Stealer shows a fake web page asking macOS users to update to the latest version of Safari. (Image Source: Malwarebytes)

Also Read | How to get Microsoft Copilot in Windows 10

What can Atomic Stealer do?

When users browse a website compromised by ClearFake, they are shown a fake Chrome or Safari browser update page asking them to update to the latest version if they want to see the content on the website. The template Chrome and Safari update page looks just like the official one and is available in different languages as well.

If users download and install the update from the fake page, the malware steals information like passwords, credit card numbers, Wi-Fi passwords, website logins, documents, cookies and other sensitive data from Windows and macOS machines.

According to a report by Bleeping Computer, the stolen information is then purchased by cybercriminals via Telegram channels for around $1,000 per month. Atomic Stealer was discovered earlier this year in March still remains undetected by around half the anti-virus engines used by the popular malware scanning website VirusTotal.

If you want to stay safe from the malware, make sure to ignore any pages that ask you to update your web browser and only use the built-in updater tool that automatically downloads the latest version.

From the homepage