Technology
Shamos malware tricks Mac users with fake fixes
NEWYou can now listen to Fox News articles!
A dangerous new malware campaign is targeting Mac users worldwide. Security researchers at CrowdStrike uncovered Shamos, a new variant of the Atomic macOS Stealer (AMOS), developed by a cybercriminal group called COOKIE SPIDER.
The attack relies on ClickFix tactics, where victims searching for Mac troubleshooting help are lured to fake websites or GitHub repositories. These spoofed sites trick users into copying and pasting a one-line command in Terminal, supposedly to fix an error. Instead, the command silently downloads Shamos, bypasses macOS Gatekeeper protections, and installs the malware.
Once inside, Shamos searches for sensitive data, Apple Notes, Keychain items, browser passwords, and even cryptocurrency wallets. The stolen information is zipped and sent directly to attackers, often alongside additional malware like botnet modules or fake Ledger wallet apps.
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER
10 WAYS TO SECURE YOUR OLDER MAC FROM THREATS AND MALWARE
Malicious sponsored results can be seen on Google search. (CrowdStrike)
How Shamos malware spreads on macOS
Cybercriminals distribute these fake “fixes” through so-called “malvertising” campaigns and spoofed tech help sites with names like mac-safer[.]com or rescue-mac[.]com. These pages pose as trusted troubleshooting guides and appear in search results for common Mac issues, such as “how to flush resolver cache.”
The websites encourage victims to copy and paste commands that download malicious Bash scripts. These scripts grab the user’s password, remove file protections, and launch Shamos. With persistence tools installed, the malware can even restart alongside the system, keeping control long after the initial infection.
CAPTCHAGEDDON SIGNALS A DANGEROUS SHIFT
A fake help page provides victims with false instructions about how to fix problems with their Mac computer. (CrowdStrike)
Tips to stay safe from Shamos malware
You can avoid falling victim to Shamos and similar threats with these proactive steps:
1) Never run commands you don’t understand
Copy-pasting commands into Terminal may seem like an easy fix, but it’s also one of the easiest ways for attackers to bypass Apple’s built-in protections. If you see a command on a website, forum, or GitHub repository, don’t execute it unless you fully understand what it does. Instead, confirm with Apple’s official support site or the Apple Community forums, where experienced users and moderators can verify safe troubleshooting steps.
2) Avoid sponsored results
Hackers know that when your Mac has a problem, you’ll search for a quick solution. That’s why they buy sponsored ads like the one below to push fake troubleshooting websites higher in search results. Clicking the top link may feel natural, but it could be a trap. Stick with trusted sources like Apple Support, or scroll past the ads to find legitimate guides.
Fake instructions on how to fix printer issues on macOS. (CrowdStrike)
3) Be wary of GitHub projects
GitHub is an amazing resource for developers, but it’s also become a hotspot for malicious repositories that mimic legitimate software. Attackers often clone popular apps or tools, then hide malware inside. Before downloading anything, check the publisher’s name, stars, and activity history. If the account looks suspicious, inactive, or brand-new, avoid it.
4) Use strong antivirus protection
Mac malware is evolving fast, and Apple’s built-in security features can’t catch everything. A strong antivirus adds another layer of defense by scanning downloads, blocking malicious scripts, and detecting suspicious behavior in real time. Some security tools can even spot the one-line Terminal commands used by Shamos before they cause harm.
Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech
5) Use a personal data removal service
Since Shamos is designed to steal personal information and send it to cybercriminals, reducing your online footprint can help limit the fallout. A personal data removal service scans data broker sites and removes your exposed information, making it harder for attackers to resell or exploit it after a breach. While this won’t stop malware from stealing what’s on your Mac, it adds another layer of protection by minimizing the data criminals can use against you.
Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete
Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan
6) Keep macOS updated
Apple regularly patches vulnerabilities in macOS that malware tries to exploit. By keeping your system up to date, you close the doors that attackers rely on. Enable automatic updates, so your Mac receives the latest patches as soon as they’re available. Pairing this with good digital hygiene, like avoiding shady downloads, dramatically lowers your risk of infection.
Kurt’s key takeaways
Cybercriminals know that when your Mac breaks, you’ll look for quick answers. Shamos takes advantage of that urgency by disguising itself as help. Staying safe means slowing down before you copy, paste, or download anything. If something feels off, it probably is.
Should Apple be doing more to protect Mac users from evolving threats like Shamos? Let us know by writing to us at Cyberguy.com/Contact
Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER
Copyright 2025 CyberGuy.com. All rights reserved.
Technology
Now the FAA says gamers are the answer to its air traffic controller shortage
The Federal Aviation Administration (FAA) has struggled for years to have enough air traffic controllers to address shortages, with the US Government Accountability Office (GAO) saying in January that the number of people in the job in the US has declined by around 6 percent “in the last decade.” Now the Trump administration is rolling out a recruiting campaign targeting gamers ahead of the opening of the annual air traffic control hiring window on April 17th.
Even with the campaign, getting qualified individuals through training and into the role may still be a challenge: according to the Department of Transportation’s Office of Inspector General (OIG), the FAA is facing “considerable challenges with training, including a shortage of qualified instructors, training capacity limitations, an outdated curriculum, and high training failure rates.”
An FAA video full of clips of things like Madden NFL, Fortnite, League of Legends esports, and the Xbox One stinger from commercials promises an average salary of $155,000 per year after three years and says that “you’ve been training for this.”
In a press release, the FAA says that air traffic controllers said in exit interviews that gaming was an influence on “their ability to think quickly, stay focused, and manage complexity.” The FAA’s website about the application process encourages applicants to “level up” their career. However, the Trump administration isn’t the first to target gamers for the role; according to The New York Times, the Biden administration launched a “Level Up” recruiting push in 2021, encouraging gamers as well as women and members of minority groups to become air traffic controllers.
Getting more air traffic controllers has been a focus for Sean Duffy, President Trump’s secretary of transportation, and he announced a plan to “supercharge” hiring shortly after he was sworn in for the job last year. That campaign closed in March 2025 and “attracted more than 10,000 applications,” resulting in about 600 trainees entering the Controller Training Academy, the OIG says. And the GAO says that some attrition during the air traffic controller hiring process “may be preventable,” noting that the hiring process can be “difficult to navigate” and that applicants may have already accepted other jobs by the time they get an employment offer.
The National Air Traffic Controllers Association (NATCA), the union representing air traffic controllers, “welcomes innovative approaches to expanding the candidate pool,” including “outreach to individuals with high-level aptitude skills such as gamers,” according to a statement from NATCA president Nick Daniels.
Technology
Google search led to a costly scam call
NEWYou can now listen to Fox News articles!
You book a flight. You reschedule. Then you try to handle travel insurance quickly so you can move on with your day. That’s exactly what happened to Rosette. She was trying to reach Allianz, a large travel insurance company that many airlines direct customers to after booking.
Within seconds, she was talking to a scammer who sounded completely legitimate. Here’s how she described it:
“I Googled Allianz and clicked on the phone number. It was answered within 1 second. . . . It was NOT Allianz I was speaking to. They have my Citicard number and my date of birth. . . . When I questioned it, he said ‘I will not charge your card’ and disconnected.”
That realization hits hard. Suddenly, you start replaying everything in your head. Maybe you thought you knew what to look for. Still, the frustration sets in fast. Here’s the truth: This happens every day to smart, careful people. And the scams keep getting more convincing.
TECH GIANTS UNITE TO FIGHT ONLINE SCAMS
Fake phone numbers in search results are fueling a surge in travel insurance scams targeting unsuspecting callers. (Yuliya Taba/Getty Images)
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com — trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
How this fake travel insurance phone scam works
This is known as a search result scam, and it is one of the fastest-growing fraud tactics right now.
Here’s the typical playbook:
- You search for a company like a travel insurance provider, airline or your bank
- A fake phone number appears at the top of the results or in an ad
- You call and reach a professional-sounding call center
- The scammer acts helpful, fast and confident
- They ask for payment details or personal information
In Rosette’s case, there were several clear signs once you step back:
- The call was answered instantly
- The pricing felt unusually high
- The email came from a fake domain
- The agent pushed for authorization
Once she questioned it, the scammer disconnected. That’s classic behavior.
Why this phone scam is so easy to fall for
This is not sloppy fraud. It’s polished, fast and designed to catch you when you are distracted. Here’s why it works so well:
1) You trust search results
Most people assume search results are safe. Scammers exploit that trust with fake listings and ads.
2) Timing creates pressure
You are often dealing with travel changes, delays or deadlines. That lowers your guard.
3) They sound legitimate
These are not obvious scammers. Many operate scripted call centers with trained agents.
4) They move fast
Answering within seconds creates the illusion that you reached the right company.
SSA IMPERSONATION SCAMS ARE GETTING MORE PERSONAL
A quick Google search led one woman to a convincing scam call center posing as a legitimate insurer. (golibo/Getty Images)
What information did the scammer actually get?
In Rosette’s situation, the scammer obtained:
- Credit card number
- Date of birth
That combination matters. Even without an immediate charge, scammers often:
- Test small transactions later
- Attempt identity-based fraud
- Sell your data to other criminals
This is why you should treat it as a compromised card situation, even if nothing has been charged yet.
What this means to you
This type of scam does not rely on hacking your device. It relies on tricking you into calling the wrong number. That means anyone can fall for it.
You could be booking travel, fixing a billing issue or calling tech support. One wrong click puts you in direct contact with a scammer who already sounds like the real company.
The danger is not just the initial call. It is what happens next if your information is reused or shared.
How to protect yourself from fake phone scams
Here’s how to protect yourself from this exact scenario moving forward:
1) Never trust phone numbers from search results
Always go directly to the company’s official website and find the contact page there.
2) Use the number on your card or confirmation email
These are far more reliable than anything you find through a quick search.
3) Watch for instant answers and pressure
Real companies rarely answer instantly and push for immediate payment details.
WHY THAT $4 CHARGE ON YOUR STATEMENT COULD BE FRAUD
A traveler searching for Allianz support reached a scammer instead, exposing personal and financial information in seconds. (fizkes/Getty Images)
4) Check the email domain carefully
If it does not match the official company domain, it is a red flag.
5) Replace compromised cards immediately
Do not wait for fraud to appear. Request a new card number right away.
6) Turn on real-time alerts
Enable transaction alerts so you can catch suspicious activity early.
7) Freeze your credit if personal data is exposed
This adds a strong layer of protection against identity theft.
8) Consider identity theft protection
If your personal information was exposed, identity theft protection can monitor your identity, alert you to suspicious activity and help you respond quickly if something goes wrong. See my tips and best picks on Best Identity Theft Protection at Cyberguy.com.
9) Remove your personal data from public databases
Data broker sites collect and sell your personal details. Removing your information reduces the chances scammers can find and target you again. Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com.
What Rosette did right
It’s important to call this, out because it matters.
- She questioned the pricing
- She challenged the caller
- She stopped before a charge went through
- She contacted her bank quickly
Those steps significantly reduced the damage. This could have gone much further.
Kurt’s key takeaways
Scams like this are not about being careless. They are about being human. You were trying to solve a problem quickly. The scammer was ready for that exact moment. The biggest takeaway is simple: Slow down when money or personal information is involved. Even a few extra seconds to verify a phone number can make all the difference. And if something feels off, trust that instinct.
If you needed to call your bank or airline right now, would you trust the first number you see online? Let us know by writing to us at Cyberguy.com.
CLICK HERE TO DOWNLOAD THE FOX NEWS APP
Sign up for my FREE CyberGuy Report
- Get my best tech tips, urgent security alerts and exclusive deals delivered straight to your inbox.
- For simple, real-world ways to spot scams early and stay protected, visit CyberGuy.com — trusted by millions who watch CyberGuy on TV daily.
- Plus, you’ll get instant access to my Ultimate Scam Survival Guide free when you join.
Copyright 2026 CyberGuy.com. All rights reserved.
Technology
Microsoft starts removing Copilot buttons from Windows 11 apps
Microsoft is starting to remove “unnecessary” Copilot buttons from its Windows 11 apps. In the latest version of the Notepad app for Windows Insiders, Microsoft has removed the Copilot button in favor of a “writing tools” menu. The Copilot button in the Snipping Tool app also no longer appears when you select an area to capture.
The change is part of “reducing unnecessary Copilot entry points, starting with apps like Snipping Tool, Photos, Widgets and Notepad,” that Microsoft promised to complete as part of its broader plan to fix Windows 11. While Copilot buttons are being removed, it looks like the underlying AI features are here to stay, though.
The Copilot button has been removed from Notepad, but the writing tools replacement still uses AI-powered features and looks like the identical menu of options that existed before. I still think these features are largely unnecessary in what’s supposed to be a lightweight text app, but removing the superfluous Copilot branding is a good first step.
-
Atlanta, GA6 days ago1 teenage girl killed, another injured in shooting at Piedmont Park, police say
-
Education1 week agoVideo: Toy Testing with a Discerning Bodega Cat
-
Movie Reviews1 week agoVaazha 2 first half review: Hashir anchors a lively, chaos-filled teen tale
-
Georgia4 days agoGeorgia House Special Runoff Election 2026 Live Results
-
Pennsylvania4 days agoParents charged after toddler injured by wolf at Pennsylvania zoo
-
Arkansas17 hours agoArkansas TV meteorologist Melinda Mayo retires after nearly four decades on air
-
Milwaukee, WI5 days agoPotawatomi Casino Hotel evacuated after fire breaks out in rooftop HVAC system
-
Entertainment1 week agoInside Ye’s first comeback show at SoFi Stadium