A large-scale malvertising operation targets macOS users with fake Google Ads leading to malicious text-sharing sites. These lures deliver the AMOS infostealer variant, dubbed “malext,” which steals sensitive data such as browser credentials and crypto wallets.
Suspicious password prompts halted the compromise, revealing initial domains like optimize-storage-mac-os[.]medium[.]com, octopox[.]com, and vagturk[.]com.
Google Ads Library exposed over 34 ads pushing Medium.com lures, with attackers rapidly replacing banned accounts.
Analysis found 53+ compromised ad accounts, including one promoting cruises alongside fake macOS fixes. Similar ads hit Evernote.com, mssg.me, and kimi.com platforms.
Researchers @itspappy and Gi7w0rm uncovered the attack after a near-miss incident. A user searching for macOS storage fixes clicked a top Google result, landing on a fake Medium post with a malicious shell command.
Lures mimic troubleshooting guides for macOS issues or software installs. Pages feature headlines like “This method fixes X,” followed by Terminal commands to copy-paste.
Base64-obfuscated curls chain downloads, stripping quarantine attributes with xattr -c to evade Gatekeeper.
Some chains prompt for admin passwords via loops, storing them in ~/.pass for later sudo use. This social engineering boosts payload execution without alerts.
Kill Chain Analysis
Commands download Mach-O binaries supporting x86_64 and ARM. These run VM/sandbox checks via obfuscated AppleScript using system_profiler for QEMU/VMware detection or odd hardware signatures. Patched samples ran in VirusTotal, revealing a 59k+ char osascript payload.
Deobfuscation shows Caesar cipher strings and randomized vars. The script hides Terminal, collects system info, and exfils via malext[.]com or 38.244.158[.]56.
The “malext” AMOS variant steals broadly. It grabs Apple Notes DB, Safari cookies, Desktop/Documents files (txt/pdf/docx/wallet up to 30MB), OpenVPN profiles, Telegram data, and installed apps list.
The malware is that the macho file actually contained 2 payload binaries compiled for different CPU Architectures.
Targets 12+ Chromium browsers (Chrome/Brave/Edge etc.) for cookies/logins/history, Firefox profiles, 266 extensions (crypto/password managers), login keychain, and 16+ wallets (Electrum/Exodus/Ledger etc.). Zips data to /tmp/out.zip and POSTs with token/build ID headers.
Persistence and Backdoor
With stolen password, it trojanizes Ledger/Trezor apps via sudo replacements from malext[.]com/app.zip. Installs LaunchDaemon com.finder.helper.plist running ~/.agent loop to fetch/execute ~/.mainhelper from C2 /zxc/kito, enabling remote control.
The code sets up several config variables that can enable/disable partial functionalities, like file stealing or Apple Notes stealing.
| Feature | Description | Targets |
|---|---|---|
| Data Theft | Browsers, wallets, keychain, files | Chrome, Electrum, Notes |
| Evasion | VM check, xattr -c, gzip/Base64 | Gatekeeper, sandboxes |
| Persistence | LaunchDaemon, trojanized apps | ~/.agent, Ledger |
| C2 | HTTP POST retries, fallback IP | malext[.]com, 199.217.98.33 |
Traits match AMOS over Odyssey: com.finder.helper.plist, BuildID header, /zxc paths despite cl/cn:0 headers. Active since late 2025, it scales via cheap throwaway accounts, possibly trafficker-run.
Users should avoid untrusted Terminal commands, verify ads, and scan with antivirus. Rotate creds if exposed.
Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.
