Malvertising campaign tricks Mac users into installing AMOS infostealer through fake “how-to” pages
VPN Central [Unofficial]
March 3, 2026
Attackers now use Google Search ads to lure macOS users onto fake help pages that tell them to paste a Terminal command. When the victim runs the command, it pulls down a script and installs an infostealer, including Atomic macOS Stealer (AMOS), also known as Atomic Stealer. Microsoft says these “ClickFix” copy-paste prompts have hit […]
The post Malvertising campaign tricks Mac users into installing AMOS infostealer through fake “how-to” pages appeared first on VPN Central.
Discussion in the ATmosphere