Cybersecurity researchers have discovered a new malware campaign that targets Mac users through malicious ads for Google searches, tricking them into installing the “Atomic Stealer (AMOS)” malware, a new report has said.
According to the cybersecurity company Malwarebytes, AMOS is being delivered to unsuspecting searchers via a Google ad scheme.
“AMOS was first advertised in April 2023 as a stealer for Mac OS with a strong focus on crypto assets, capable of harvesting passwords from browsers and Apple’s keychain, as well as featuring a file grabber. The developer has been actively working on the project, releasing a new version at the end of June,” the researchers said.
Criminals who purchase the toolkit distribute the malware primarily through cracked software downloads, but they also impersonate legitimate websites and use ads on search engines such as Google to lure victims in.
According to the report, users who want to download a new programme naturally go to Google and search for it. Threat actors are purchasing advertisements that look like well-known brands and tricking victims into visiting their site as if it were the official one.
Once the user clicks the link, they are presented with a normal-looking page. The attackers create a near-perfect clone of the website users expect, so they click through and download the software.
After opening the file, a fake prompt for the system password appears repeatedly until the user relents and enters their password.
It then extracts as much information as it can from the user’s Keychain, file system, and crypto wallets and sends it to the malware’s operator, the report explained.
