Cybersecuritynews Malvertising Campaign Distributes AMOS ‘malext’ Infostealer to macOS Users
Article Content
Browse articles 
A malvertising campaign has emerged, targeting macOS users globally with a new variant of the AMOS infostealer known as 'malext.' Attackers are utilizing Google ads to direct victims to fake help articles on text-sharing websites, where a deceptive terminal command installs the malware silently on their devices.
Ask AI about this cluster
Answers cite the sources they use
Updated 182d ago How this analysis works
Timeline
2026-03-03
Malvertising campaign identified delivering AMOS 'malext' infostealer
Date unknown
Attackers purchase Google ads for fake help articles
Date unknown
Deceptive terminal command installs malware on macOS devices
More articles in this cluster (3)
Following this threat?
Track AMOS in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
Infostealer Malware Hijacks Claude Sessions, Drains User Accounts Anthropic has alerted users that infostealer malware is compromising Claude accounts by hijacking active login sessions, allowing attackers to deplete usage limits without needing passwords or two-factor authentication. The malware, identified as Vidar, LummaC2, StealC, RedLine, and Acreed on Windows, and Atomic… 
Fake Codex Installer Delivers Suspected AMOS Infostealer via Google Sites A malicious campaign has emerged, using fake Codex installation pages to deliver malware targeting macOS users. The attackers utilize Google Sites to host a fraudulent download portal that appears legitimate, tricking users into executing a command that initiates a multi-stage malware infection. The command, disguised…