Malvertising Campaign Spreads AMOS ‘malext’ macOS Infostealer via Fake Text-Sharing Ads

A global malvertising campaign uses fake Google Ads and Medium-style lures to trick macOS users into running obfuscated shell commands that install an AMOS infostealer variant (“malext”). The malware supports both ARM and x86_64, performs VM/sandbox checks, strips quarantine attributes to evade Gatekeeper, steals browsers, wallets, Apple Notes, keychain and files, establishes persistence via LaunchDaemons and trojanized apps, and exfiltrates data to malext.com and fallback IPs; researchers observed dozens of compromised ad accounts and multiple IoCs.