Fake macOS Help Sites Distribute Infostealer in Targeted Campaign

What's Happening?

A targeted malvertising campaign has been identified, using fake macOS help sites to distribute a variant of the Atomic macOS Stealer (AMOS) infostealer. The campaign, active between June and August 2025, aimed to infect users with the SHAMOS variant by tricking them into executing a malicious installation command. CrowdStrike has blocked attempts to compromise over 300 customer environments.

Why It's Important?

This campaign highlights the evolving tactics of cybercriminals and the importance of vigilance in cybersecurity. The use of fake help sites to distribute malware underscores the need for users to verify the authenticity of online resources. Organizations must remain proactive in protecting their systems and educating users about potential threats to prevent data breaches and financial losses.