Feed: Slashdot
Feed Link: https://slashdot.org/
---

Title: Fake Homebrew Google Ads Push Malware Onto macOS

Link: https://it.slashdot.org/story/25/10/21/225624...

joshuark shares a report from BleepingComputer: A new malicious campaign is
targeting macOS developers with fake Homebrew, LogMeIn, and TradingView
platforms that deliver infostealing malware like AMOS (Atomic macOS Stealer)
and Odyssey. The campaign employs "ClickFix" techniques where targets are
tricked into executing commands in Terminal, infecting themselves with
malware. Researchers at threat hunting company Hunt.io identified more than
85 domains impersonating the three platforms in this campaign [...]. When
checking some of the domains, BleepingComputer discovered that in some cases
the traffic to the sites was driven via Google Ads, indicating that the
threat actor promoted them to appear in Google Search results. The malicious
sites feature convincing download portals for the fake apps and instruct
users to copy a curl command in their Terminal to install them, the
researchers say. In other cases, like for TradingView, the malicious commands
are presented as a "connection security confirmation step." However, if the
user clicks on the 'copy' button, a base64-encoded installation command is
delivered to the clipboard instead of the displayed Cloudflare verification
ID.

Read more of this story at Slashdot.

---
VRSS v2.1.180528