Connect with us

Technology

Over 2,800 websites used to spread AMOS malware

Published

on

Over 2,800 websites used to spread AMOS malware

Ransomware gangs once thrived on infected email attachments and bogus invoices, but security-savvy users and hardened mail gateways have weakened those tactics. Attackers are now focusing on a subtler trick that targets the small checkbox labeled “I’m not a robot” that most people click without thinking. 

A widespread campaign known as MacReaper has compromised more than 2,800 legitimate websites and redirects visitors to an infection process designed specifically for Apple computers. The operation relies on visual trust signals, including a convincing fake of Google’s reCAPTCHA, along with hidden clipboard code that ends with the installation of Atomic macOS Stealer malware, a data-harvesting infostealer distributed through Telegram.

Join the FREE “CyberGuy Report”: Get my expert tech tips, critical security alerts and exclusive deals, plus instant access to my free “Ultimate Scam Survival Guide” when you sign up!

A woman working on her laptop (Kurt “CyberGuy” Knutsson)

How does the attack unfold?

When a Mac user visits one of the compromised websites, they don’t see the page they were expecting. Instead, the site displays a full-screen imitation of Google’s familiar reCAPTCHA box.

Advertisement

This fake reCAPTCHA appears harmless, simply asking the user to click “I’m not a robot.” However, when the user clicks the box, a hidden command is silently copied to their clipboard. Immediately afterward, the page displays a friendly message, complete with familiar macOS keyboard shortcut visuals, explicitly instructing the user to open Terminal and paste what they’ve just copied. If the user follows these instructions, the command downloads and runs the malicious file known as Atomic macOS Stealer (AMOS).

This trick is specifically targeted at Mac users. The website checks the visitor’s operating system and only activates the attack if it detects macOS. For Windows or Linux users, the site behaves normally. Researchers have dubbed this infection method “ClickFix,” referencing the single click that initiates the attack chain.

At the center of this campaign is AMOS, a sophisticated piece of malware that has become notorious in cybercrime circles. AMOS is available for rent on Telegram, with some versions costing attackers up to $3,000 per month. Once installed, AMOS can steal a wide array of sensitive data: it can extract Wi-Fi and app passwords stored in Keychain, collect browser cookies and autofill data, list system information and scan through personal folders such as Desktop and Documents. It is also capable of identifying and targeting more than 50 types of cryptocurrency wallets.

Fake reCAPTCHA (Cyber Security News) (Kurt “CyberGuy” Knutsson)

THE HIDDEN COSTS OF FREE APPS: YOUR PERSONAL INFORMATION

Advertisement

Macs aren’t as secure as Apple wants you to believe

MacReaper challenges two widely held beliefs. The first is that everyday CAPTCHA checks are just harmless speed bumps. The second is that macOS provides a level of built-in security that keeps most attackers at bay. In reality, a single click can expose Keychain credentials, active browser sessions and cryptocurrency wallets.

These are exactly the kinds of targets that attract credential-stuffing groups and profit-driven cybercriminals. Because the attack is triggered by the user, many network monitoring tools treat the traffic as normal, leaving security teams with little to investigate. In environments where Macs and Windows machines share identity systems, one compromised Mac can open access to single sign-on portals, cloud storage and even production codebases.

A woman working on her laptop (Kurt “CyberGuy” Knutsson)

SPOTIFY PLAYLISTS ARE BEING HIJACKED TO PROMOTE PIRATED SOFTWARE AND SCAMS

6 ways you can stay safe from MacReaper attack

To protect yourself from the evolving threat of the MacReaper attack, which continues to target users through sophisticated social engineering tactics, consider implementing these six essential security measures.

Advertisement

1) Be skeptical of CAPTCHA prompts: Legitimate CAPTCHA tests never require you to copy commands or paste anything into Terminal. If a website instructs you to do this, it’s likely a scam. Close the page immediately and avoid interacting with it.

2) Don’t click links from unverified emails and use strong antivirus software: Many MacReaper attacks start with phishing emails that impersonate trusted services. Always verify the sender before clicking on links. If an email seems urgent or unexpected, go directly to the company’s official website instead of clicking any links inside the email.

The best way to safeguard yourself from malicious links that install malware, potentially accessing your private information, is to have strong antivirus software installed on all your devices. This protection can also alert you to phishing emails and ransomware scams, keeping your personal information and digital assets safe. Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android and iOS devices.

3) Enable two-factor authentication: Enable two-factor authentication whenever possible. This adds an extra layer of security by requiring a second form of verification, such as a code sent to your phone, in addition to your password.

4) Keep devices updated: Regularly updating your operating system, browser and security software ensures you have the latest patches against known vulnerabilities. Cybercriminals exploit outdated systems, so enabling automatic updates is a simple but effective way to stay protected.

Advertisement

5) Monitor your accounts for suspicious activity and change your passwords: If you’ve interacted with a suspicious website, phishing email or fake login page, check your online accounts for any unusual activity. Look for unexpected login attempts, unauthorized password resets or financial transactions that you don’t recognize. If anything seems off, change your passwords immediately and report the activity to the relevant service provider. Also, consider using a password manager to generate and store complex passwords. Get more details about my best expert-reviewed password managers of 2025 here.

6) Invest in a personal data removal service: Consider using a service that monitors your personal information and alerts you to potential breaches or unauthorized use of your data. These services can provide early warning signs of identity theft or other malicious activities resulting from MacReaper or similar attacks. While no service promises to remove all your data from the internet, having a removal service is great if you want to constantly monitor and automate the process of removing your information from hundreds of sites continuously over a longer period of time. Check out my top picks for data removal services here.

MASSIVE SECURITY FLAW PUTS MOST POPULAR BROWSERS AT RISK ON MAC

Kurt’s key takeaway

MacReaper makes it clear that the most durable exploits aren’t zero-days but borrowed moments of trust, an authentic-looking CAPTCHA, a helpful-sounding fix, a clipboard that does what it’s told. As Apple tightens the technical screws with Rapid Security Responses and notarization, expect adversaries to double down on such psychological levers. The counter-strategy is to hard-bake healthy skepticism into user behavior and to instrument Macs with the same telemetry layers enterprises already expect from Windows. Security, in other words, has finally become a platform-agnostic muscle, and complacency is the riskiest operating system of all.

Do you think tech companies are doing enough to stop malware like MacReaper? Let us know by writing us at Cyberguy.com/Contact.

Advertisement

For more of my tech tips and security alerts, subscribe to my free CyberGuy Report Newsletter by heading to Cyberguy.com/Newsletter.

Ask Kurt a question or let us know what stories you’d like us to cover.

Follow Kurt on his social channels:

Answers to the most-asked CyberGuy questions:

New from Kurt:

Advertisement

Copyright 2025 CyberGuy.com. All rights reserved.

Technology

The first Dolby FlexConnect soundbar is coming from LG

Published

on

The first Dolby FlexConnect soundbar is coming from LG

Dolby Atmos FlexConnect technology debuted this year with the TCL Z100 speakers, and now we’re getting our first FlexConnect soundbar thanks to LG. The new H7 soundbar — which runs on the same Alpha 11 Gen 3 chip as LG’s OLEDs and new Micro RGB LED — is a part of the LG Sound Suite, a modular home audio system the company will debut at CES 2026. In addition to the soundbar, the Sound Suite will include the M5 and M7 surround speakers and the W7 subwoofer. All of the speakers feature Peerless Audio components.

The two main drawbacks of TCL’s Dolby FlexConnect implementation were the limitation of only allowing four connected speakers, including a sub, and the need for a 2025 QM series TCL TV. So you needed to pick between better sound coverage with a fourth speaker or more bass performance with a sub. LG’s Sound Suite, on the other hand, will allow you to connect the soundbar with up to four surround speakers and a subwoofer for a potential 13.1.7-channel system.

And while the speakers can be used with a compatible LG TV (including the 2026 premium LG TV lineup and 2025’s C5 and G5 OLEDs), it isn’t required. It’s possible to use the H7 soundbar with any TV — or without — and have it act as what’s called the lead device to connect the surround speakers and sub. LG says there are 27 different speaker configurations possible, from using two speakers as a stereo pair up to the full system with soundbar, surrounds, and sub.

In my experience with the TCL Z100, calibrating FlexConnect speakers to your space is also fast. Once they’re in place and plugged in, a short musical clip is played for a few seconds and then setup is complete. The system is able to know where the speakers are placed and how to optimize the surround and Atmos sound for your room. With other room correction software, the process can take much longer, requiring taking sound readings from multiple locations in the room.

LG is using ultra-wideband technology to adjust the sweet spot based on your listening position that it’s calling Sound Follow. What will be interesting to see with the LG Sound Suite’s Dolby FlexConnect implementation is how customizable it is after setup (for instance, adjusting subwoofer levels).

Advertisement

I’ll be hearing the system at CES and plan on reviewing the system when it’s available to see how well the technology translates into a home.

Continue Reading

Technology

The fake refund scam: Why scammers love holiday shoppers

Published

on

The fake refund scam: Why scammers love holiday shoppers

NEWYou can now listen to Fox News articles!

The holiday shopping season should feel exciting, but for scammers, it’s rush hour. And this year, one trick is hitting more inboxes and phones than ever: the fake refund scam. If you’ve ever seen an unexpected “Your refund has been issued,” “Your payment failed” or “We owe you money” email or text during November or December, it wasn’t an accident.

Scammers know you’re buying more, tracking more packages and juggling more receipts than at any other time of year. That chaos makes fake refund scams incredibly effective and incredibly dangerous.

Here’s why these scams are spreading, how to spot them instantly and the one thing you can do today to stop scammers from targeting you in the first place.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter.

Advertisement

FBI WARNS EMAIL USERS AS HOLIDAY SCAMS SURGE

Fake refund emails can look convincing during the holidays, making it easy to fall for a scam when your inbox is overflowing. (Kurt “CyberGuy” Knutsson)

Why refund scams skyrocket during the holidays

Scammers strike when Americans are distracted, rushed and making dozens of purchases. Black Friday, Cyber Monday and holiday gift-buying create the perfect storm:

1) You’re expecting legitimate refunds

Holiday shopping means:

  • Items going out of stock
  • Orders getting canceled
  • Packages arriving late
  • Prices changing
  • Stores offering “Best Price Guarantee” refunds.

Scammers know this. When you’re already expecting refund emails, their fake ones blend right in.

2) You’re spending more, which means bigger targets

A study shows that this year, Americans will spend 3.6% more than the previous year on holiday shopping. A $200 to $500 purchase is completely normal during this season. Other reports show a decrease in spending, but note that people spend, on average, over $600 during the Black Friday promotions alone.

Advertisement

Expenses stack up, new things arrive, some get returned and a “$249 refund issued” message doesn’t look suspicious—it looks plausible. But it’s crucial you check if that message is real. Never click any links without a thorough look at the email address, name and content of the message.

3) Your inbox is overflowing

Have you been eyeing a new home appliance? Or a present for a loved one? Have you saved anything in your cart just to see if the price drops? Thanks to Black Friday, your inbox is probably filled with:

  • Promotional codes
  • Offers
  • Shipping updates
  • Order confirmations
  • Receipts
  • Return notifications.

It’s easy to lose track of your orders and packages amidst the influx of emails. And when you’re skimming more than 200 promotions, scams become harder to catch.

4) They know exactly what you purchased

Scammers get their information from data brokers, companies that collect, package and sell your personal information. Your profile can include anything from your name, contact information, to your purchase history and even your financial situation.

In general, data brokers and shopping apps sell patterns, including:

  • Where you shop
  • How much you spend
  • What categories you buy
  • Recent purchases
  • Your email, phone number and address.

And scammers buy that information to craft compelling and personalized attacks. That’s why their fake refund emails often mimic retailers you actually used.

HOW TO STOP IMPOSTOR BANK SCAMS BEFORE THEY DRAIN YOUR WALLET

Advertisement

Scammers use urgent warnings and realistic details to pressure you into clicking links that steal your personal information. (Kurt “CyberGuy” Knutsson)

How the fake refund scam works

Scammers usually follow one of three playbooks:

“Your refund is ready-verify your account.” You click a link, and you’re taken to what looks like Amazon, Walmart, UPS, Target or Best Buy. And when you enter your login, scammers can steal your credentials by manipulating you.

“We overcharged you. Click here for your refund.” It asks for your debit card number, your bank login and your PayPal credentials. Or worse: it installs malware that steals them automatically.

Phone version: “We issued a refund by mistake.” You get a call from someone pretending to be Amazon customer service, PayPal support, or even your bank. They say they “refunded too much money” and need you to send back the difference. Some even screen-share to drain bank accounts in real time.

Advertisement

These scams cost Americans hundreds of millions of dollars every year. The FTC reports that impostor scams (which are related to online shopping) accounted for the second-highest reported losses, resulting in $2.95 billion being lost in 2024.

What these emails look like so you can spot them fast

Scammers are getting more sophisticated. Fake refund messages often include:

  • Your correct name
  • A real store logo
  • A real order amount
  • A believable order number
  • “Click to view refund” buttons
  • Deadline pressure like “respond within 24 hours.”

Here’s the giveaway: No legitimate retailer requires you to enter banking info to receive a refund, ever.

Note that scams often ask you to:

  • Confirm a payment
  • Verify personal info
  • Log in through a link
  • Provide banking details
  • Download an invoice.

The simplest way to protect yourself before the holiday peak

Deleting your data manually from data broker sites is technically possible, but extremely tedious. Some require government ID uploads, faxed forms, multiple follow-up requests and updates every 30 to 90 days because they relist your data.

This is why most people almost never do it. A data removal service, however, automates the entire process. These services:

  • Identify which broker sites have your info
  • Send official deletion requests on your behalf
  • Force them to remove your data
  • Continually monitor and re-request removals
  • Block brokers from relisting you

While no service can guarantee the complete removal of your data from the internet, a data removal service is really a smart choice. They aren’t cheap, and neither is your privacy. These services do all the work for you by actively monitoring and systematically erasing your personal information from hundreds of websites. It’s what gives me peace of mind and has proven to be the most effective way to erase your personal data from the internet. By limiting the information available, you reduce the risk of scammers cross-referencing data from breaches with information they might find on the dark web, making it harder for them to target you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com

Advertisement

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com

Criminals often rely on data from broker sites to personalize refund scams, which is why reducing your digital footprint matters. (Kurt “CyberGuy” Knutsson)

How to protect yourself this season (3 quick steps)

Remember to follow these few simple steps to safeguard yourself against targeted scams.

1) Never click refund links in emails or texts

Go directly to your retailer’s website and check your actual order history. Verify the email address of the sender and only communicate with official representatives of the retailer.

2) Turn on multi-factor authentication

Set up two-factor authentication (2FA) for all of your accounts. With the help of 2FA, you’ll need to authorize logins via email, text message or generated PINs. So, even if you accidentally enter your password somewhere fake, 2FA can stop the breach.

Advertisement

3) Limit how scammers can find you

This is the part most people skip—and it’s why they stay targets. Removing your personal info from data broker sites cuts off scammers’ access to your real details. A data removal service automates and makes the process ongoing, which is why I recommend it to my most privacy-conscious readers.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.

Kurt’s key takeaways

Refund scams explode during the holiday shopping season because scammers rely on two things: Chaos in your inbox and your personal data being sold behind your back. You can’t stop scammers from sending fake emails, but you can stop them from targeting you specifically. Before peak holiday shopping hits, take a moment to clean up your data trail. You’ll end up with fewer scams, fewer risks and far more peace of mind.

Have you received a suspicious refund email or text this season? Share your experience so we can help warn others in the comments below. Let us know by writing to us at Cyberguy.com

CLICK HERE TO DOWNLOAD THE FOX NEWS APP

Advertisement

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM newsletter. 

Copyright 2025 CyberGuy.com.  All rights reserved.

Advertisement
Continue Reading

Technology

Rad Power Bikes files for bankruptcy protection

Published

on

Rad Power Bikes files for bankruptcy protection

Rad Power Bikes, the once dominant electric bicycle brand in the US, filed for Chapter 11 bankruptcy protection this week as it seeks to sell of its company. The move comes less than a month after Rad Power said it could not afford to recall its older e-bike batteries that had been designated a fire risk by the US Consumer Protection Safety Commission.

The bankruptcy, which was first reported by Bicycle Retailer, was filed in US Bankruptcy Court for the Eastern District of Washington, near the company’s headquarters in Seattle. Rad Power lists its estimated assets at $32.1 million and estimated liabilities at $72.8 million. Its inventory of e-bikes, spare parts, and accessories is listged at $14.2 million, Bicycle Retailer says.

It’s a stunning reversal for the once leading e-bike company in the US. Mike Radenbaugh founded the company in 2015 after several years of selling custom-made e-bikes to customers on the West Coast. Rad Power quickly grew to over 11 distinct models, including the fat-tire RadRover, the long-tail RadWagon, and the versatile RadRunner. Rad Power Bikes raised an approximate total of $329 million across several funding rounds, primarily in 2021, with major investments from firms like Fidelity, Morgan Stanley, and T. Rowe Price.

But in the wake of the post-covid bike boom, things started to go south. There were supply chain disruptions, safety recalls, several rounds of layoffs, and executive turnover. Last month, Rad Power said it was facing “significant financial challenges” that could lead to its imminent closure without a cash infusion.

The CPSC warning apparently was the nail in the coffin. The company’s older batteries could “unexpectedly ignite and explode,” the agency warned, citing 31 fires, including 12 reports of property damage totaling $734,500. There weren’t any injuries, but the company said it couldn’t afford a costly recall.

Advertisement

Rad Power could still live on if its able to find a buyer for its assets and brand. Dutch e-bike make VanMoof was able to find a buyer following its 2023 bankruptcy. And Belgium’s Cowboy is in talks to be acquired by a French holding company of several bike brands. Rad Power will continue to operate as it restructures its debts under court supervision, and in a statement to Bicycle Retailer said it will continue to sell bikes and work with customers and vendors as it moves forward with the process.

Continue Reading

Trending