#mac targeted malware

[the-wisper-report]

AMOS ClickFix Attack

Macs are generally considered at less risk for malware due to their proprietary software and, frankly, smaller hold of the market share (at least with computers; iPhones on the other hand…). But less risk is still some risk. And with the growing prevalence of AI use providing a vector, type of operating system is starting to have nothing to do with safety. The most recent example is the ongoing AMOS attack via OpenAI and Grok.

Atomic macOS Stealer (AMOS) itself isn’t new, it was first reported on in 2023. Unlike other AI-generated malware campaigns, this isn’t using prompt injection, but instead is utilizing weaponized AI through a ClickFix attack. A search for common troubleshooting help will result in AI generated guides. The link to the guide looks legitimate but has been produced via search engine optimization (SEO) poisoning, a tactic used to make malicious sites look and act genuine to further the reach of their payload. Often these links will be at the top of a search page, which reduces the likelihood that users will search more thoroughly before clicking on them.

AMOS is an infostealer, the fastest growing cyberthreat of this year, according to an earlier Kapersky report. This family harvests passwords, cookies, documents and other credentials from infected devices and is one of the man-in-the-middle tools for ransomware campaigns. This particular offshoot of the family tree also uses ‘living-off-the-land’ to harvest credentials without a graphical prompt. It employs the native dscl utility to validate the user’s password silently in the background, according to Cyber Security News’ report, which goes into further detail on how AMOS accomplishes its execution.

There are a couple of main takeaways from this news:

SEO poisoning is cross-platform, since it’s a common tactic across Windows compromises as well as macOS. It’s the backbone of malvertising that is so often used in today’s phishing attempts. I’ve reported before on malicious npm and APK packages that use this technique.

But more importantly, follow the age old internet safety rule of do not click an untrusted link. And never comply with a ‘guide’ that urges one to copy and paste anything into a command line or terminal.

It’s easy to say ‘don’t do this if you don’t understand it’ as a warning against falling for phishing or ClickFix schemes, but that has more than a touch of competency bias attached to it. I’ve often stated that computer literacy is dropping. The average person on the street does not know how their device does what it does, nor are they fluent in the language in which many of these codes are written. This is why I write these reports, to help educate the layperson.

Legitimate helpdesk guides will come from the vendor – or at least be included in a subreddit thread – and not an AI-generated result. This campaign is banking on user trust of AI, but that trust is misplaced already considering how often these tools have inaccurate information in their aggregation or contradict themselves. Kapersky’s report on AMOS even states that querying whether or not the actions presented by this attack are safe – while in the chatbox to execute it – will return with a ‘no’. Trust nothing, question everything, and as always, if you’ve gotten in over your head, your friendly neighborhood WISP is here to help.

Posted on LinkedIn, 12/11/25

[the-wisper-report]

Bad Apples

Broadly speaking, when cybersecurity experts talk about the prevalence of malware, they are talking about the effects on Windows systems. And Mac users breathe a sigh of relief that they don’t have those kinds of problems. Due to the difference in proprietary software which underpins all of their operating systems, Macs are generally safer. They have robust built in protection and fewer redundant files which can be corrupted or usurped.

But Mac users shouldn’t get too complacent. Malware is out there for them too. Backdoors exist.

In much the same way phishing attempts often carry Trojans, and can appear from many vectors besides fake emails, so too can backdoor hacks. They are presented typically in the same way as any other malware, disguised as legitimate updates or downloads. And once they are installed, they open the literal back door for exploitation and malicious activity.

In February of this year, a campaign attributed to North Korean threat actors was targeting macOS users in the cryptocurrency industry. The malware being used was RustDoor, a backdoor disguised as a software update. It also used a Koi stealer aimed at macOS to exfiltrate sensitive data (source: OpenCTI). RustDoor is an example of a cross-platforming malware, since it can also attack Windows based systems.

No operating system is truly invulnerable in today’s market. The very nature and evolution of global communication means that cross-platform software is a requirement to do business. Windows devices are often more vulnerable due to the open source nature of their OS’s – and their sheer volume, as they control a much larger portion of the market share – while Macs retain much of their security from their closed source coding. As always, however, user education and caution are the key ingredients to online safety and security. And when in doubt, your friendly neighborhood WISP is here to help.

Posted on LinkedIn 9/2/25