More Mac malware from Google search

A new wave of the AMOS (SOMA) stealer is targeting macOS users, employing sophisticated social engineering tactics to exploit Google search results and trusted platforms. This malware campaign, similar to a previous attack facilitated by ChatGPT, delivers its payload by luring users into executing obfuscated commands in their Terminal.

• Attack Vector: Malicious links appear in Google's sponsored results and even on docs.google.com and business.google.com, often pointing to compromised Medium articles or forged 'official' Apple support pages.
• Deception: Users are prompted to paste seemingly innocuous but ultimately malicious curl commands into their Terminal, which then download and execute the AMOS stealer.
• Malware Capabilities: The stealer collects user data, including the contents of the Documents folder, Notes, and alarmingly, plaintext passwords, writing hidden files like .agent (an AppleScript) and .mainHelper (Mach-O binary) to the user's Home folder.
• Bypassing Security: macOS protections are circumvented because users are tricked into willingly performing the actions that grant the malware access.
• User Advice: The author strongly recommends distrusting search results, especially sponsored ones, critically assessing URL provenance, and never blindly executing obfuscated Terminal commands without fully understanding their actions.

Ultimately, this campaign highlights how social engineering remains a potent threat, demonstrating that even robust operating system security can be nullified when users are manipulated into enabling malicious activities.