30
30
30
Go-Based macOS Malware Steals Crypto and Secrets
Security researchers detected Go-based macOS malware stealing cryptocurrency, passwords, and other secrets from infected systems.
A Go-based malware variant targeting macOS has been detected in active use. The malware steals cryptocurrency, passwords, and other sensitive secrets from infected Macs.
45
30
30
30
30
30
30
30
30
30
30
30
30
Fake Codex Download Uses Google Sites to Deliver macOS Malware
Fake OpenAI Codex download pages on Google Sites, pushed via sponsored search and ClickFix lures, deliver malware to macOS users.
Threat actors are hosting fake Codex download pages on Google Sites and promoting them through sponsored search results. Victims are walked through ClickFix social engineering that leads to malware installation on macOS systems. The campaign abuses trusted Google infrastructure and search ads to reach Mac users.
45
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
30
Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
Unit 42 analyzed an AMOS (Atomic macOS Stealer) infection from August 5, 2026, initiated via a page at getmacouscloud[.]com instructing users to paste a command into Terminal. The command fetched a Zsh script from ferncore13[.]com that delivered a Mach-O installer to /tmp/helper and supporting files under /Library/Application Support/.com.apple.accountsd/ and .com.apple.metadata.mds/. AMOS collected browser data, credentials, cryptocurrency wallets (Binance, TonKeeper), Telegram data, and FileGrabber content such as AWS and gcloud files, uploading it via HTTP POST to C2 server 161.35.146[.]120. AMOS has been advertised on Telegram since April 2024 and distributed via ClickFix campaigns, malicious ads, and cracked-software sites.
45