Over 2,800 Websites Compromised to Distribute AMOS Stealer Malware

Over 2,800 Hacked Websites Targeting MacOS Users with AMOS Stealer Malware

Image courtesy of GBHackers News

Cybersecurity researchers have identified a substantial malware campaign targeting MacOS users through approximately 2,800 compromised websites. This operation, named “MacReaper,” employs sophisticated social engineering and blockchain technology to distribute the Atomic Stealer (AMOS) malware, which can extract passwords, cryptocurrency wallets, and sensitive data from Apple devices.

The campaign was first detected on May 4, 2025, via a compromised Brazilian news site, marking one of the largest coordinated attacks against the MacOS platform. The attackers utilize a deceptive method known as “ClickFix” or “ClearFix,” presenting fake Google reCAPTCHA verification prompts solely to MacOS users. When users click “I’m not a robot,” they receive a verification dialog detailing MacOS-specific instructions to open Terminal.

This method enables the malware to copy malicious commands to the clipboard, which, when executed, leads to the installation of AMOS. The malware, available on underground forums since April 2023 as a Malware-as-a-Service priced between $1,000 and $3,000 monthly, employs a signed Mach-O binary that can bypass MacOS Gatekeeper security measures.

Blockchain-Based Infrastructure

A distinctive feature of this campaign is its use of “EtherHiding,” where malicious commands are concealed within Binance Smart Contract blockchain transactions to avoid detection and ensure resilience against takedowns. This strategy provides attackers with a robust command and control infrastructure that traditional security measures struggle to disrupt.

The investigation commenced with agencia2.jornalfloripa.com.br and expanded as researchers uncovered thousands of other sites employing similar attack techniques. The delivery system utilizes obfuscated JavaScript and multiple full-screen overlays, along with blockchain-based command retrieval, to enhance the likelihood of a successful attack while making detection difficult.

Once installed, AMOS targets valuable user data, including Keychain passwords, browser information, cryptocurrency wallets, system details via system_profiler, and files stored in Desktop and Documents folders. The malware specifically targets over 50 cryptocurrency wallets and extensions, presenting a significant financial risk to users.

Protect Your Mac from This Threat

Security experts recommend several strategies to safeguard against this escalating threat:

1. Avoid executing Terminal commands prompted by websites, especially those appearing through CAPTCHA or verification interfaces.
2. Monitor network traffic for suspicious connections to domains like technavix.cloud or salorttactical.top, which are associated with this campaign.
3. Utilize endpoint detection tools capable of identifying unusual Keychain access or system_profiler execution.
4. Implement content security policies to prevent unauthorized scripts on websites you manage.
5. Keep your macOS and security software updated with the latest patches.

If you suspect your device has been compromised, it is advisable to quarantine the system, scan with MacOS-specific antivirus tools, and reset passwords for Keychain, browsers, and cryptocurrency wallets.

This discovery underscores the increasing sophistication of threats targeting Apple’s ecosystem, with around 2,800 compromised websites identified, ranging from news outlets to personal blogs. The scale of this operation indicates a well-resourced threat actor focusing on the expanding MacOS user base globally.

Image courtesy of Cyber Security News

The AMOS malware operation highlights the critical need for effective cybersecurity monitoring and response strategies. Organizations can leverage tools like GrackerAI, an AI-powered cybersecurity marketing platform, to transform security news into actionable content opportunities. GrackerAI empowers marketing teams to identify emerging trends, monitor threats, and create relevant content that resonates with cybersecurity professionals and decision-makers. By automating insights from industry developments, GrackerAI helps organizations generate timely and targeted marketing materials, ensuring they stay ahead in the cybersecurity landscape.