The facts

AMOS, short for Atomic macOS Stealer, is an information thief sold by subscription, malware for rent that anyone pays for monthly to haul in a loot from their victims’ Macs. It already grabs the Keychain, cookies, crypto wallets, whole files. The new part comes in two pieces.

One. Anthropic confirmed it in late August, thieves of this kind, AMOS included in a few Mac cases, have hijacked Claude sessions. Not by breaking Claude, by copying the session already open in your browser. Two. A security team showed in late July that the token for Claude Code, the command line version, does live in the macOS Keychain, but behind a lock that is far too loose, any program running under your account reads it with no password, no Touch ID, nothing.

This one hits home. Mac Souverain talks about local AI and cloud AI in article after article, and here is a class of malware aimed squarely at the tool a chunk of our readers run every single day. No need to panic though. The threat is real, the mechanism is known, and the weak spot is neither on Apple’s side nor on Claude’s. It comes down to you.

How it gets in

AMOS exploits no exotic flaw. No macOS zero-day, no hole in Claude. The vector is you.

The technique on the rise is called ClickFix. A web page or a message shows a fake “system error” or “human verification” window, with a harmless looking instruction: “paste this line into the Terminal to fix it”. The line is a curl ... | bash, it downloads the payload and runs it in one go. You think you’re fixing a bug, you install the thief yourself. One August campaign was impersonating Claude through exactly this trick, poisoned ads and a fake support window included.

The other ways in are cut from the same cloth. A fake .dmg of a “cracked” app, a fake installer, a fake updater. Every time, it’s social engineering, not hacking. The malware doesn’t force your door, it talks you into opening it.

What changes, and the two false reflexes

Let’s start with the real stakes. A stolen session token means acting on your AI account without ever needing your password. The password and two-factor authentication protect the login, the moment a token is issued. They protect nothing once it is. Stealing the token bypasses both at once, and that token stays valid for a good while, a plain local logout changes nothing, more on that below. Add the history of your conversations, in the clear on disk, a map of your environment, what you work on, what you automate, what you have access to.

Now, the two reflexes that feel reassuring and do nothing.

The first is chmod. You set your sensitive files to 600, you feel covered. Except AMOS runs under your own user account. As far as the system is concerned, that program is you. It owns those files, it has read access by construction. 600, 700, 400, none of it changes a thing for it. POSIX permissions arbitrate between different users, not between you and a program launched in your name. That is exactly what makes the Keychain token readable in one line.

The second is “I’ve got an antivirus”. AMOS is sold as a service, updated non stop, it changes shape from one campaign to the next. Signatures are always a step behind. An antivirus catches yesterday’s version, not the one pasted onto you today.

What actually protects you comes down to three levers, each with its share of honest truth.

Copy-paste hygiene. There is no legitimate reason to paste into your Terminal a command a web page or a message pushes you to run. Serious software never makes you “fix” or “verify” anything by dictating a line to paste. The one that pops up and rushes you, you don’t paste it, ever. The only copy-paste that holds up is the one you went looking for yourself, in the docs of a tool you chose to install.

Execution control. An allowlisting tool like Santa in lockdown mode only lets run the programs you have approved. Be clear eyed about what it does, it does not stop the booby-trapped line from firing, bash is already approved, your curl ... | bash runs and downloads its charge. What it blocks is the decisive link, the moment the unsigned thief binary tries to run, Santa kills it. A stealer like AMOS always ends up dropping a real program on your disk, and that’s where it dies, even when you got fooled. Its limit, anything that plays out entirely as a script, a fake password prompt for instance, slips under its radar. And no, Gatekeeper does not play this role either, it inspects downloaded apps at launch, it never sees a script pasted into the Terminal.

Revocation, no kidding yourself. A stolen token, you can’t make it unreadable to a program running in your name, and you can’t cancel it with a snap of your fingers either. Logging out on the command line only wipes the local copy, the token already issued stays accepted by the servers for a few more days. The only revocation that counts goes through your account, you invalidate the sessions and the Claude Code instances from the online settings, and you regenerate your API key if you have one.

That’s what I do. Execution under Santa’s allowlist, and one dumb rule, no command goes through the Terminal without me reading it. And the day something feels off, I don’t settle for a logout, I cut the sessions from my account and treat the machine as dirty until it’s cleaned.

What you do now

1. Don’t trust a plain logout. On a Mac, logging out of Claude Code locally wipes the copy of the token, but the already stolen token stays valid server side for a few more days. Real revocation happens through your account, you invalidate the sessions and the Claude Code instances in the online settings, and you regenerate your API key if you have one. Above all, treat the machine as compromised, you rotate every exposed secret, not just your Claude session, and you don’t log back in on a still-infected box.

2. Set up execution control. An allowlisting tool like Santa in lockdown mode won’t block the pasted line itself, but it kills the thief binary the moment it tries to run, the safeguard that acts even when you got fooled. Its limit, a payload that stays pure script slips right past it, which is why copy-paste hygiene goes with it. Don’t count on Gatekeeper for this, it doesn’t see a script piped into an interpreter.

3. Build the anti-ClickFix reflex. A command someone pushes you to paste “to verify” or “to fix”, you don’t paste it. Ever. There’s nothing legitimate behind a line that pops up and rushes you to open the Terminal.

Sources

• Anthropic, via BleepingComputer (30 August 2026), infostealers, including AMOS in limited Mac cases, hijacked Claude sessions by copying the browser session, which bypasses password and 2FA.
• Silverfort (28 July 2026), the Claude Code OAuth token stored in the macOS Keychain is readable by any process of the same user, with no password, due to an overly permissive ACL.
• Huntress (17 August 2026), malvertising campaign impersonating Claude, ClickFix vector (curl | bash pasted into the Terminal).
• Trend Micro (September 2025), profile of AMOS, a macOS infostealer sold as Malware-as-a-Service, spread through cracked apps and commands pasted into the Terminal.