How to Neutralize AMOS (Atomic Stealer Mac OS) If you pressed DENY Full Disk Access

Step 1 for any active infostealer encounter is to disconnect the Mac from Wi-Fi immediately

If the Pop-up "accounthelper wants full disk access" appears, press Deny. Immediately. Congrats, you just severely mitigated the malware. Now, the virus can't steal very important data of yours, and sooner or later your Mac will say it found malware (AMOS) and deleted it.

But no. This is the tip of the iceberg of a very aggressive virus that won't stop coming back. Now, here you'd think to leave your computer and go on your day and wake up tomorrow. Now, just imagine it's the tomorrow I spoke about just now. You feel worried that maybe your Mac didn't fully clean it up, so you download Malwarebytes for Mac. And you find out there are 2 (or more) detections and quarantine them. But you ARE NOT done yet. If you go to Settings and check Privacy & Security on your Mac and click Full Disk Access, you might see siriactionsd, AccountsHelper, and Googleupdater all turned off. And you might wonder if these aren't the virus.

Well, they are. They didn't ask for access because your Mac found out they tried to pull off an illegitimate change on YOUR Mac, so your Mac denied the change. Now you aren't safe yet. But click on ANY of them (DO NOT click the switch, though, otherwise you are d-o-n-e FUCKED), and on the bottom of the application you'll see a minus and a plus. Click minus on ANY of them (but not GoogleUpdater yet), then get rid of the other. Now hopefully you're left with GoogleUpdater. This seems legit, but click it (again, DO NOT click the switch; otherwise you are d-o-n-e FUCKED) and right-click it. Now you will see Show In Finder. Click that, and if the folder it is in is "Support" delete that shit; click it (not clicking the switch) and find that minus button and press it. Now you're NEARLY done.

If you suddenly decide to end it there, DO NOT. You might shut down your Mac and check back on Full Disk Access, but you'll see siriactionsd is back along with others, maybe. Now these smart assholes coded that every time you shut down your Mac and open it again, the virus opens along with it. So now we have to find the culprit behind this booter before our Mac system is safe.

Now, go to Finder and press Cmd+Shift+G, and paste this exact following path: ~/Library/LaunchAgents
Now you will see launch agents that help launch an app.

Look inside this folder for any strange or unfamiliar .plist files. Highly suspicious names to target include: com.apple.accountsd.helper.plist Anything containing siriactionsd, CkSync, Nova, or a string of random characters. If you find any of these, right-click them and select Move to Trash.

And if you see com.google.GoogleUpdat…ake.plist or ANYTHING with literally GoogleUpdater
Now you might be left with two more txt of Google and then Keystone. Delete those; they are a part of this virus. Now empty the trash and run Malwarebytes. If zero detections appear, congrats. You are done. Just restart your Mac, check Full Disk Access, and none of that malware should pop up there. Now just check your Google Logins and any suspicious activity were done. If none show up…

Congrats. AMOS was Neutralized