11737 stories
·
23 followers

Google ads for fake Homebrew, LogMeIn sites push infostealers

1 Comment

Google ads for fake Homebrew, LogMeIn sites push infostealers

A new malicious campaign is targeting macOS developers with fake Homebrew, LogMeIn, and TradingView platforms that deliver infostealing malware like AMOS (Atomic macOS Stealer) and Odyssey.

The campaign employs “ClickFix” techniques where targets are tricked into executing commands in Terminal, infecting themselves with malware.

Homebrew is a popular open-source package management system that makes it easier to install software on macOS and Linux. Threat actors have used in the past the platform's name to distribute AMOS in malvertising campaigns.

LogMeIn is a remote access service, and TradingView is a financial charting and market analysis platform, both widely used by Apple users.

Researchers at threat hunting company Hunt.io identified more than 85 domains impersonating the three platforms in this campaign, including the following:

<a href="http://homebrewclubs.org/" rel="nofollow">http://homebrewclubs.org/</a> <a href="https://sites-phantom.com/" rel="nofollow">https://sites-phantom.com/</a>
<a href="http://homebrewfaq.org/" rel="nofollow">http://homebrewfaq.org/</a> <a href="https://tradingviewen.com/" rel="nofollow">https://tradingviewen.com/</a>
<a href="http://homebrewlub.us/" rel="nofollow">http://homebrewlub.us/</a> <a href="https://tradingvieweu.com/" rel="nofollow">https://tradingvieweu.com/</a>
<a href="http://homebrewonline.org/" rel="nofollow">http://homebrewonline.org/</a> <a href="https://www.homebrewclubs.org/" rel="nofollow">https://www.homebrewclubs.org/</a>
<a href="http://homebrewupdate.org/" rel="nofollow">http://homebrewupdate.org/</a> <a href="https://www.homebrewfaq.org/" rel="nofollow">https://www.homebrewfaq.org/</a>
<a href="http://sites-phantom.com/" rel="nofollow">http://sites-phantom.com/</a> <a href="https://www.homebrewfaq.us/" rel="nofollow">https://www.homebrewfaq.us/</a>
<a href="http://tradingviewen.com/" rel="nofollow">http://tradingviewen.com/</a> <a href="https://www.homebrewonline.org/" rel="nofollow">https://www.homebrewonline.org/</a>
<a href="http://tradingvieweu.com/" rel="nofollow">http://tradingvieweu.com/</a> <a href="https://www.homebrewupdate.org/" rel="nofollow">https://www.homebrewupdate.org/</a>
<a href="http://www.homebrewfaq.us/" rel="nofollow">http://www.homebrewfaq.us/</a> <a href="https://www.tradingvieweu.com/" rel="nofollow">https://www.tradingvieweu.com/</a>
<a href="http://www.homebrewonline.org/" rel="nofollow">http://www.homebrewonline.org/</a> <a href="https://filmoraus.com/" rel="nofollow">https://filmoraus.com/</a>
<a href="http://www.tradingviewen.com/" rel="nofollow">http://www.tradingviewen.com/</a> <a href="https://homebrewfaq.org/" rel="nofollow">https://homebrewfaq.org/</a>
<a href="https://filmoraus.com/" rel="nofollow">https://filmoraus.com/</a> <a href="https://homebrewfaq.us/" rel="nofollow">https://homebrewfaq.us/</a>
<a href="https://homebrewfaq.org/" rel="nofollow">https://homebrewfaq.org/</a> <a href="https://homebrewlub.us/" rel="nofollow">https://homebrewlub.us/</a>

When checking some of the domains, BleepingComputer discovered that in some cases the traffic to the sites was driven via Google Ads, indicating that the threat actor promoted them to appear in Google Search results.

The malicious sites feature convincing download portals for the fake apps and instruct users to copy a curl command in their Terminal to install them, the researchers say.

In other cases, like for TradingView, the malicious commands are presented as a “connection security confirmation step.” However, if the user clicks on the 'copy' button, a base64-encoded installation command is delivered to the clipboard instead of the displayed Cloudflare verification ID.

The commands fetch and decode an ‘install.sh’ file, which downloads a payload binary, removing quarantine flags an bypass Gatekeeper prompts to allow its execution.

The payload is either AMOS or Odyssey, executed on the machine after checking if the environment is a virtual machine or an analysis system.

The malware explicitly invokes sudo to run commands as root, and its first action is to collect detailed hardware and memory information of the host.

Next, it manipulates system services like killing OneDrive updater daemons and interacts with macOS XPC services to blend its malicious activity with legitimate processes.

Eventually, the information-stealing components of the malware are activated, harvesting sensitive information stored on the browser, cryptocurrency credentials, and exfiltrating to the command and control (C2).

AMOS, first documented in April 2023, is a malware-as-a-service (MaaS) available under a $1,000/month subscription. It can steal a broad range of data from infected hosts.

Recently, its creators added a backdoor component to the malware to give operators remote persistent access capabilities.

Odyssey Stealer, documented by CYFIRMA researchers this summer, is a relatively new family derived from the Poseidon Stealer, which itself was forked from AMOS.

It targets credentials and cookies stored in Chrome, Firefox, and Safari browsers, over a hundred cryptocurrency wallet extensions, Keychain data, and personal files, and sends them to the attackers in ZIP format.

It is strongly recommended that users don't paste in the Terminal commands found online if they don’t fully understand what they do.

Read the whole story
freeAgent
6 hours ago
reply
Google wants to force all app distribution on Android to run through them because of "security," but they're unable to stop hackers from utilizing those same distribution channels.
Los Angeles, CA
Share this story
Delete

Aura introduces a $499 e-ink digital photo frame that lets you go cordless

1 Comment
Aura, founded by early Twitter employees, has launched the $499 Ink frame, its first 13-inch color e-paper photo frame. Using Spectra 6 e-ink technology, it offers a cordless design with up to three months of battery life and a subtle front light for better contrast.
Read the whole story
freeAgent
6 hours ago
reply
Neat!
Los Angeles, CA
Share this story
Delete

“Butt breathing” might soon be a real medical treatment

1 Share

Last year, a group of researchers won the 2024 Ig Nobel Prize in Physiology for discovering that many mammals are capable of breathing through their anus. But as with many Ig Nobel awards, there is a serious side to the seeming silliness. The same group has conducted a new study on the feasibility of adapting this method to treat people with blocked airways or clogged lungs, with promising results that bring rectal oxygen delivery one step closer to medical reality.

As previously reported, this is perhaps one of the more unusual research developments to come out of the COVID-19 pandemic and its associated shortages of ventilators and artificial lungs to assist patients’ breathing and prevent respiratory failure. The Cincinnati Children’s Hospital Medical Center team took their inspiration from the humble loach, a freshwater bottom-dwelling fish found throughout Eurasia and northern Africa. The loach (along with sea cucumbers) employs intestinal breathing (i.e., through the anus) rather than gills to survive under hypoxic conditions, thanks to having lots of capillary vessels in its intestine. The technical term is enteral ventilation via anus (EVA).

Would such a novel breathing method work in mammals? The team thought it might be possible and undertook experiments with mice and micro-pigs to test that hypothesis. They drew upon earlier research by Leland Clark, also of Cincinnati Children’s Hospital, who invented a perfluorocarbon liquid called Oxycyte as a possible form of artificial blood. That vision never materialized, although it did provide a handy plot point for the 1989 film The Abyss, in which a rat is able to “breathe” in a similar liquid.

And Oxycyte was ideal for the group’s 2021 Ig Nobel-winning efforts. The experiments involved intra-anally administering oxygen gas or a liquid oxygenated perfluorocarbon to the unfortunate rodents and porcines. Yes, they gave the animals enemas. They then induced respiratory failure and evaluated the effectiveness of the intra-anal treatment. The result: Both treatments were pretty darned effective at staving off respiratory failure with no major complications.

Visual abstract shows highlights of first human clinical trial to evaluate the safety of enteral ventilation concept Credit: Cincinnati Children's/Med

So far, so good. The next logical step was to determine if EVA could work in human patients, too. “Patients with severe respiratory failure often need mechanical ventilation to survive, but these therapies can cause further lung injury,” the authors wrote in this latest paper. EVA “could give the lungs a chance to rest and heal.”

The team recruited 27 healthy adult men in Japan, each of whom received a dose of non-oxygenated perfluorodecalin via the anus. They were asked to retain the liquid for a full hour as the dosage slowly increased from 25 to 1,500 mL. Twenty of the men successfully completed the experiment. Apart from mild temporary abdominal bloating and discomfort—which proved to be dosage dependent and resolved with no need for medical attention—they experienced no adverse effects.

“This is the first human data and the results are limited solely to demonstrating the safety of the procedure and not its effectiveness,” said co-author Takanori Takebe of Cincinnati Children’s Hospital and the University of Osaka in Japan. “But now that we have established tolerance, the next step will be to evaluate how effective the process is for delivering oxygen to the bloodstream.”

Med, 2025. DOI: 10.1016/j.medj.2025.100887 (About DOIs).

Read full article

Comments



Read the whole story
freeAgent
7 hours ago
reply
Los Angeles, CA
Share this story
Delete

Microsoft is killing off Office Online Server

1 Share
Microsoft has decided to retire a version of Office Online in an effort to focus on cloud-first solutions like Microsoft 365. Read more...
Read the whole story
freeAgent
7 hours ago
reply
Los Angeles, CA
Share this story
Delete

Consumer Confusion Regarding USB Power Adapters

1 Comment

Yours truly, yesterday:

The problem I see with the MacBook power adapter situation in Europe is that while power users — like the sort of people who read Daring Fireball and Pixel Envy — will have no problem buying exactly the sort of power adapter they want, or simply re-using a good one they already own, normal users have no idea what makes a “good” power adapter. I suspect there are going to be a lot of Europeans who buy a new M5 MacBook Pro and wind up charging it with inexpensive low-watt power adapters meant for things like phones, and wind up with a shitty, slow charging experience.

Actual email, from actual reader D.B. today:

Anecdotes to support your point about normal customers not knowing which power adapter to pick, I’ve had both my mother and a mid-level IT director at my work complain that their Macs no longer hold a battery. In both cases, they were using a 5 watt USB-A charger.

It’s hard for people to understand that not all USB chargers are the same.

And from actual reader D.K.:

My mother in law called me to ask why her MacBook Air no longer turned on. She had called AppleCare and they told her to bring the computer to a store for repairs. Turns out she was using a very old 5 watt USB-A iPhone charger.

And of course, the real danger isn’t using an underpowered charger. It’s thinking you can save a few bucks by buying a cheap high-watt third-party charger and then burning your house down.

Read the whole story
freeAgent
7 hours ago
reply
If you don't know that a 5-watt USB-A charger is unable to charge a Macbook, you should not be an "IT director."
Los Angeles, CA
Share this story
Delete

How Apple’s walled garden protects ICE

1 Comment

Hello and welcome to Regulator.

Of all the strange, unintended consequences stemming from major lawsuits, I never thought that the Trump administration's power to force Apple to remove ICE-tracking mobile apps from its stores could have been connected to a legal battle over Fortnite V-Bucks.

Yes, we are talking about the in-game digital currency that Fortnite players can use to buy taco hats and trending zoomer dance emotes for their avatars. Yes, they're the ones you can purchase as gift cards at CVS for a 9-year-old's emergency birthday gift. But at one point, they were the subject of two major lawsuits filed by developer Epic Games, a …

Read the full story at The Verge.

Read the whole story
freeAgent
7 hours ago
reply
I don't think they need to call the Trump administration "quasi" fascist.
Los Angeles, CA
Share this story
Delete
Next Page of Stories