Overview
A sophisticated malvertising campaign is targeting Mac and Linux users through compromised Google Ads featuring a legitimate-looking Homebrew package manager site. The campaign deploys AmosStealer malware at $1,000/month subscription rates, focusing on stealing credentials, browser data, and cryptocurrency wallets
Whom it may concern
- DevOps and System Administrators
- Mac and Linux users
- Package management system operators
- Cryptocurrency wallet holders
Key Findings
- Malicious ads mimic legitimate 'brew.sh' URL using 'brewe.sh' domain
- AmosStealer targets 50+ cryptocurrency extensions
- Google has removed identified malicious ads but campaign likely continues
- Limited project-side prevention capability due to ad platform constraints
Risk Analysis
- Probability: High (8/10)
- Impact: Severe
- Attack Vector: Social Engineering via trusted source impersonation
- Asset Exposure: Credentials, Financial Data, Crypto Assets
- Detection Rate: Medium to High due to URL discrepancy
Action Items
- Implement URL verification procedures before software installation
- Bookmark official project websites for regular access
- Disable auto-click on search results
- Deploy endpoint protection with URL filtering
- Implement 2FA on all cryptocurrency wallets
Sources
- [Bleeping Computer](https://www.bleepingcomputer.com/news/security/fake-homebrew-google-ads-target-mac-users-with-malware/)