More Mac malware from Google search
eclecticlight.co
February 8, 2026
3 min read
🔥🔥🔥🔥🔥
61/100
Summary
A new malware campaign is delivering AMOS (alias SOMA) stealers to Macs through forged Apple-like websites linked from docs.google.com and business.google.com. Malicious scripts are also being found in articles posted on Medium.
Key Takeaways
- A new malware campaign is delivering AMOS stealers to Macs via forged Apple-like sites linked from Google services and Medium articles.
- The malware can copy contents from the user's Documents folder and write hidden files, including an AppleScript for theft and a plain text password file.
- Users are advised to critically assess search engine results and verify the authenticity of links before clicking, especially those that appear promoted.
- Running commands in Terminal without understanding their function can lead to security breaches, as seen with obfuscated commands used by malware.
Coverage & discussions
Hacker News · eclecticlight.co
Community discussions
Community Sentiment
Positives
- Leveraging AI, particularly LLMs, for command verification can enhance security by reducing reliance on potentially harmful websites for technical guidance.
Concerns
- The inability of browsers to access home directories limits the development of potentially useful applications, highlighting a significant gap in user experience and security.
