Advertised on Telegram, Atomic Stealer operates as a Malware-as-a-Service with a web interface for attackers. Specializing in info-stealing, it can exfiltrate a range of sensitive data, such as account passwords, browser data, session cookies, and cryptocurrency wallets. Notably, Atomic abuses AppleScript dialog functions to deceive users into providing their credentials. Once the user's password is entered, it pilfers additional sensitive data from the macOS keychain. Distributed under the guise of legitimate applications like Tor Browser, Photoshop CC, Notion, and Microsoft Office, the malware has also been observed being promoted via malvertising on Google Ads.