Cookie Spider


COOKIE SPIDER (active since at least October 2018) develops and rents Atomic macOS Stealer (AMOS), an information stealer targeting macOS victims via multiple delivery methods, including search engine optimization (SEO) poisoning, fake job advertisements, and malicious VSCode extensions. COOKIE SPIDER currently advertises and provides updates about AMOS on the malware’s dedicated Telegram channel ...

Community Identifiers



  • 6zA1q5j7heIyxDZ


  • xVZYfJwn

Contact our team about
IOCs for this adversary


During a cybersecurity incident, indicators of compromise (IoC) are clues and evidence of a data breach.