Google Ads push fake Claude downloads on claude.ai that install stealers
macOS ClickFix commands fetch Atomic macOS Stealer; a Windows Artifact runs a packed .NET payload with remote access.
1
Stories per day · 30 days
2 RSS
10 stories, newest first · one card per story
Stories tagged #amos
Fake Claude downloads on claude.ai and Google Ads push stealers
Mac users who paste the ClickFix command get Atomic macOS Stealer; a separate Windows lure delivers an encrypted .NET payload.
ClickFix Lures Deploy ChainScript RAT Using Polygon to Rotate C2 Infrastructure
Blackpoint details new ChainScript RAT spread via ClickFix lures that uses a Polygon smart contract to rotate C2 infrastructure.
3
Atomic macOS (AMOS) Stealer Activity
Unit 42 details an August 2026 AMOS macOS stealer infection delivered via fake 'macOS toolkit' pages and Terminal paste commands, exfiltrating credentials to C2.
HBO Max’s verified Reddit account hijacked to spread malware
Cybercriminals hijacked HBO Max's verified Reddit account to run 108 ClickFix ads pushing AMOS and Amatera infostealers via fake HBO app sites.
Attackers hijack HBO Max’s Reddit account for 48-hour malvertising blitz
Attackers hijacked HBO Max's verified Reddit account to push 108 ClickFix infostealer ads delivering AMOS, MacSync, and crypto clippers.
Hackers Hijack HBO Max Reddit Account to Push 108 ClickFix Malware Ads
Hijacked verified HBO Max Reddit account ran 108 ClickFix malvertising ads delivering AMOS infostealers, Windows loaders, and crypto clipboard hijackers.
HBO Max Reddit Account Hijacked to Spread PasteSwitch ClickFix Malware
Hijacked HBO Max verified Reddit account ran 108 ClickFix malvertising ads delivering AMOS and Amatera stealers plus crypto clippers to macOS and Windows users.
Google Doc Sidebar Sends Mac and Windows Users Down Different Paths to Malware
Huntress analysts trace one X direct message into separate Mac and Windows malware chains delivering AMOS infostealer and NetSupport Manager RAT.
1
Post-DEF CON Phishing Uses Malicious Google Doc to Deliver Malware
Huntress uncovered post-DEF CON phishing via X direct messages using a malicious Google Doc to deliver AMOS and NetSupport RAT malware.