Atomic Stealer, malware targeting Mac users, first appeared in April. The malware, which is sold for $1,000 via Telegram, takes the user’s system password by opening windows one after another on the infected computer, and then steals passwords, files and more. Now, this malware infects through Google search results.Be careful when searching for programs on Google!
According to the Malwarebytes report, AMOS shows itself as an ad approved by Google in search results. The fact that it appears at the top of the page and carries Google’s advertising approval mark gives the impression that it is safe, but it is not.
When the user clicks on the link, he encounters an ordinary-looking web page. Since an almost perfect copy of the website the user is searching for is created, the user downloads the program thinking that Google has approved it. Since AMOS is a temporarily signed application, the user is directed to a different process than the normal installation process. When the downloaded file is opened, a fake system password window is shown. When the user enters the password, all data, from the Keychain to the file system to the crypto wallets, is collected and sent to the person or persons who prepared the malware.
After all, when downloading a program from Google (especially free ones), it is necessary to pay attention to the directed address, software installer, and installation directions of the software as well as the URL itself. In addition, the system password screen does not appear randomly and does not contain typos.
58231
