Back Newsbytesapp

Hackers are going after macOS users with sneaky new malware

Newsbytesapp • December 19, 2025

A fresh wave of cyberattacks is targeting macOS users with the Atomic macOS Stealer (AMOS) malware. Attackers are getting creative—using fake Google ads, lookalike websites, cracked app pages, and even bogus ChatGPT/Grok links to trick people into pasting harmful commands into their Terminal. This move lets them slip past Apple's built-in security.

Once someone runs the malicious command, it secretly downloads scripts that pop up password requests and install both AMOS and a backdoor for remote access. The malware then grabs everything from your Keychain passwords and browser logins to crypto wallet info, Telegram data, Wi-Fi credentials, and personal docs. Security experts warn that AMOS is now sold as "Malware-as-a-Service," making these attacks more common in 2025—even though many think Macs are safer than Windows PCs. Stay sharp before entering commands you find online!

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

New AMOS Malware Targets macOS Users via Deceptive Tactics A new malware called Atomic macOS Stealer (AMOS) is targeting macOS users through deceptive methods. Attackers are using fake Google ads, lookalike websites, and fraudulent links to trick users into executing harmful commands in their Terminal, which allows the malware to bypass Apple's security measures. Once executed, the malware installs AMOS and a backdoor for remote access. 1 sources 32

Extracted Entities

Hackers are going after macOS users with sneaky new malware

The full story

Extracted Entities

Attack Types (1)

Malware (1)

Platforms (1)