{"id":64923,"date":"2025-02-02T21:06:38","date_gmt":"2025-02-02T21:06:38","guid":{"rendered":"https:\/\/peraltafinancing.com\/apple-2\/cuckoo-returns-mac-malware-spreads-via-legit-looking-google-ads\/"},"modified":"2025-02-02T21:06:38","modified_gmt":"2025-02-02T21:06:38","slug":"cuckoo-returns-mac-malware-spreads-via-legit-looking-google-ads","status":"publish","type":"post","link":"https:\/\/fivemor.com\/?p=64923","title":{"rendered":"Cuckoo returns; Mac malware spreads via legit-looking Google Ads"},"content":{"rendered":"


\n<\/p>\n

\n

Malware<\/a><\/p>\n

\n

\n Posted on
\n


\n Joshua Long<\/a> <\/span><\/p>\n

\"\" <\/p>\n<\/header>\n

\"\"<\/p>\n

Over the past couple years, we\u2019ve written a lot about stealer malware that infects Macs<\/a>. One malware family that frequently resurfaces is Atomic Stealer<\/strong>, or AMOS<\/strong> (short for Atomic macOS Stealer). AMOS is designed to exfiltrate sensitive data from infected Macs; this typically includes things like saved passwords, cookies, autofill text, and cryptocurrency wallets. A sub-variant known as Cuckoo<\/strong> first appeared in May 2024.<\/p>\n

Just like last year, Cuckoo has been spreading in January 2025 via elaborate campaigns, leveraging malicious but legitimate-looking Google Ads that redirect to lookalike homepages with Trojan downloads. Here\u2019s everything you need to know about the latest Cuckoo variants, and how to stay protected.<\/p>\n

In this article:<\/em><\/p>\n

A brief history of Cuckoo Mac malware<\/h3>\n

Atomic macOS Stealer (AMOS, or AtomicStealer) first surfaced<\/a> in late April 2023. At the time, a threat actor began selling it via Telegram as malware as a service<\/strong>, licensable for $1,000 per month. Since then, we\u2019ve seen a plethora of AMOS variants<\/a> emerge.<\/p>\n

Most often, AMOS malware is distributed through malicious Google Ads campaigns. These poisoned Google ads appear at the top of search results, where many people will see and click on them. In some cases, the ads are virtually indistinguishable from legitimate Google Ads run by the real software companies they mimic.<\/p>\n

Some antivirus companies dubbed a particular sub-class of AMOS variants \u201cCuckoo.\u201d Back in May 2024, we wrote about Cuckoo variants that were spreading via poisoned Google Ads that look like they redirect to the real Homebrew homepage, but in fact led to malware distribution sites.<\/p>\n

Yet another Cuckoo variant emerges<\/strong><\/h4>\n

On January 9, 2025, a malware researcher noted<\/a> that Homebrew was back with a new lookalike homepage.<\/p>\n

\n

Cuckoo is back with another fake homebrew website
brewmacos[.]com
C2: 185.62.56[.]131@birchb0y<\/a> @AdamJKohler<\/a> @L0Psec<\/a> @IntegoSecurity<\/a><\/p>\n

\u2014 Gr\u00e9goire Clermont (@gregclermont) January 9, 2025<\/a><\/p>\n<\/blockquote>\n

A little over a week later, more reports emerged with additional details; one developer reported<\/a> that he had observed a malicious Google Ads campaign leading to a different fake Homebrew site. The next day, a malware researcher posted<\/a> about a third fake Homebrew homepage.<\/p>\n

\n

\u26a0\ufe0f Developers, please be careful when installing Homebrew.<\/p>\n

Google is serving sponsored links to a Homebrew site clone that has a cURL command to malware. The URL for this site is one letter different than the official site. pic.twitter.com\/TTpWRfqGWo<\/a><\/p>\n

\u2014 Ryan Chenkie (@ryanchenkie) January 18, 2025<\/a><\/p>\n<\/blockquote>\n

The real Homebrew is a popular macOS software package manager.<\/p>\n

Each of the new fake Homebrew homepages tries to trick users into copying and pasting a command from the site into their Mac\u2019s Terminal app. While that might sound ridiculously suspicious and dangerous\u2014and it normally would be\u2014the legitimate Homebrew software is actually installed in this exact way. Both the Google Ads and lookalike pages are so convincing that many professionals have said they could have fallen for the scheme.<\/strong><\/p>\n

\"A<\/p>\n

A fake Homebrew site, part of an AMOS\/Cuckoo Mac malware campaign.<\/p>\n<\/div>\n

Compare for yourself. Would you have guessed correctly which is real, and which is fake?<\/p>\n

\"The<\/p>\n

The real Homebrew site. Ironically, it has a longer, more suspicious-looking install URL.<\/p>\n<\/div>\n

Interestingly, this is not the first time that malware has tried to disguise itself as Homebrew<\/a>. As we mentioned, there was the first Cuckoo campaign<\/a> in May 2024. Back in 2020, threat actors used another domain<\/a> that was similar to that of the real Homebrew site, as part of a typosquatting<\/a> campaign. And back in 2017, Mac malware known as Dok<\/a> used \u201chomebrew\u201d in the filename of one of its LaunchAgents.<\/p>\n

Don\u2019t \u201cjust Google it\u201d<\/h3>\n

We strongly recommend that everyone get out of the habit of \u201cjust Google it\u201d to find legitimate sites.<\/strong> Such habits often include clicking on the first link without giving it much thought, under the assumption that Google won\u2019t lead them astray, and will give them the correct result right at the top. Malware makers know this, of course, and that\u2019s why they\u2019re paying Google for the number-one position.<\/p>\n

Until or unless Google does a much better job of vetting its ads, a better practice than \u201cGoogle it\u201d would be to bookmark trusted sites whenever possible<\/strong>, and to go back to those bookmarks in the future.<\/p>\n

How can I keep my Mac safe from Cuckoo and other malware?<\/h3>\n

If you use Intego VirusBarrier, you\u2019re already protected from this malware.<\/p>\n

\"IntegoIntego VirusBarrier X9, included with Intego\u2019s Mac Premium Bundle X9<\/a><\/strong>, is a powerful solution designed to protect against, detect, and eliminate Mac malware.<\/p>\n

If you believe your Mac may be infected, or to prevent future infections, it\u2019s best to use antivirus software from a trusted Mac developer. VirusBarrier is award-winning antivirus software, designed by Mac security experts, that includes real-time protection<\/a>. It runs natively on both Intel- and Apple silicon-based Macs, and it\u2019s compatible with Apple\u2019s current Mac operating system, macOS Sonoma.<\/p>\n

One of VirusBarrier\u2019s unique features is that it can scan for malicious files on an iPhone, iPad, or iPod touch<\/a> in user-accessible areas of the device. To get started, just attach your iOS or iPadOS device to your Mac via a USB cable and open VirusBarrier.<\/p>\n

If you use a Windows PC, Intego Antivirus for Windows<\/strong><\/a> can keep your computer protected from malware.<\/p>\n

How can I learn more?<\/h3>\n

This article will be updated soon with additional indicators of compromise (IOCs) for the Mac malware samples and malicious domains used in this Cuckoo campaign. Check back here and refresh the page later for further technical details.<\/p>\n

To learn more about the previous Cuckoo variant, see Intego\u2019s original report on OSX\/Cuckoo malware<\/a>.<\/p>\n

\n

Intego discovers new \u201cCuckoo\u201d Mac malware mimicking Homebrew<\/a><\/p>\n<\/blockquote>\n