A dangerous new malware campaign is targeting Mac users worldwide. Security researchers at CrowdStrike uncovered Shamos, a new variant of the Atomic macOS Stealer (AMOS), developed by a cybercriminal group called COOKIE SPIDER.

The attack relies on ClickFix tactics, where victims searching for Mac troubleshooting help are lured to fake websites or GitHub repositories. These spoofed sites trick users into copying and pasting a one-line command in Terminal, supposedly to fix an error. Instead, the command silently downloads Shamos, bypasses macOS Gatekeeper protections, and installs the malware.

Once inside, Shamos searches for sensitive data, Apple Notes, Keychain items, browser passwords, and even cryptocurrency wallets. The stolen information is zipped and sent directly to attackers, often alongside additional malware like botnet modules or fake Ledger wallet apps.

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER  

10 WAYS TO SECURE YOUR OLDER MAC FROM THREATS AND MALWARE

Cybercriminals distribute these fake "fixes" through so-called "malvertising" campaigns and spoofed tech help sites with names like mac-safer[.]com or rescue-mac[.]com. These pages pose as trusted troubleshooting guides and appear in search results for common Mac issues, such as "how to flush resolver cache."

The websites encourage victims to copy and paste commands that download malicious Bash scripts. These scripts grab the user's password, remove file protections, and launch Shamos. With persistence tools installed, the malware can even restart alongside the system, keeping control long after the initial infection.

CAPTCHAGEDDON SIGNALS A DANGEROUS SHIFT

You can avoid falling victim to Shamos and similar threats with these proactive steps:

Copy-pasting commands into Terminal may seem like an easy fix, but it's also one of the easiest ways for attackers to bypass Apple's built-in protections. If you see a command on a website, forum, or GitHub repository, don't execute it unless you fully understand what it does. Instead, confirm with Apple's official support site or the Apple Community forums, where experienced users and moderators can verify safe troubleshooting steps.

Hackers know that when your Mac has a problem, you'll search for a quick solution. That's why they buy sponsored ads like the one below to push fake troubleshooting websites higher in search results. Clicking the top link may feel natural, but it could be a trap. Stick with trusted sources like Apple Support, or scroll past the ads to find legitimate guides.

GitHub is an amazing resource for developers, but it's also become a hotspot for malicious repositories that mimic legitimate software. Attackers often clone popular apps or tools, then hide malware inside. Before downloading anything, check the publisher's name, stars, and activity history. If the account looks suspicious, inactive, or brand-new, avoid it.

Mac malware is evolving fast, and Apple's built-in security features can't catch everything. A strong antivirus adds another layer of defense by scanning downloads, blocking malicious scripts, and detecting suspicious behavior in real time. Some security tools can even spot the one-line Terminal commands used by Shamos before they cause harm.

Get my picks for the best 2025 antivirus protection winners for your Windows, Mac, Android & iOS devices at Cyberguy.com/LockUpYourTech

Since Shamos is designed to steal personal information and send it to cybercriminals, reducing your online footprint can help limit the fallout. A personal data removal service scans data broker sites and removes your exposed information, making it harder for attackers to resell or exploit it after a breach. While this won't stop malware from stealing what's on your Mac, it adds another layer of protection by minimizing the data criminals can use against you.

Check out my top picks for data removal services and get a free scan to find out if your personal information is already out on the web by visiting Cyberguy.com/Delete

Get a free scan to find out if your personal information is already out on the web: Cyberguy.com/FreeScan 

Apple regularly patches vulnerabilities in macOS that malware tries to exploit. By keeping your system up to date, you close the doors that attackers rely on. Enable automatic updates, so your Mac receives the latest patches as soon as they're available. Pairing this with good digital hygiene, like avoiding shady downloads, dramatically lowers your risk of infection.

Cybercriminals know that when your Mac breaks, you'll look for quick answers. Shamos takes advantage of that urgency by disguising itself as help. Staying safe means slowing down before you copy, paste, or download anything. If something feels off, it probably is.

Should Apple be doing more to protect Mac users from evolving threats like Shamos? Let us know by writing to us at Cyberguy.com/Contact

Sign up for my FREE CyberGuy Report
Get my best tech tips, urgent security alerts, and exclusive deals delivered straight to your inbox. Plus, you’ll get instant access to my Ultimate Scam Survival Guide — free when you join my CYBERGUY.COM/NEWSLETTER

Copyright 2025 CyberGuy.com. All rights reserved.

Prince Harry made a surprise stop on his current trip overseas.

After arriving in London earlier this week, where he reunited with his father, King Charles, for the first time in over a year, the royal traveled to Ukraine on Friday in support of wounded service members.

According to the Associated Press, Harry arrived in Kyiv, but his specific schedule wasn't shared for security reasons.

PRINCE HARRY AND KING CHARLES REUNITE IN LONDON FOR FIRST TIME IN OVER A YEAR

Harry spoke to The Guardian during his overnight trip to Ukraine – the outlet reported that Harry will visit the National Museum of the History of Ukraine in the Second World War, spend time with 200 veterans and meet Ukrainian Prime Minister Yulia Svyrydenko.

"We cannot stop the war but what we can do is do everything we can to help the recovery process," he said.

"We can continue to humanize the people involved in this war and what they are going through. We have to keep it in the forefront of people’s minds. I hope this trip will help to bring it home to people because it’s easy to become desensitized to what has been going on."

LIKE WHAT YOU’RE READING? CLICK HERE FOR MORE ENTERTAINMENT NEWS

This is the second time Harry has visited Ukraine since the start of Russia’s full-scale invasion in 2022. He made a trip to the western city of Lviv in April.

During the April Trip, he visited the Superhumans Trauma Centre, an organization that focuses on rehabilitation for war victims. Later, he spoke with Superhumans' founder and CEO, Olga Rudnieva, during a "chance meeting" in the U.S. – that's when she urged him to visit Ukraine's capital.

"She said ‘the biggest impact you have is coming to Kyiv’. I had to check with my wife and the British government to make sure it was OK. Then the official invitation came," he recounted.

"In Lviv, you don’t see much of the war. It is so far west. This is the first time we will see the real destruction of the war."

The news of Harry's Ukraine visit comes after he met with King Charles at his London residence, Clarence House, on Wednesday.

After their meeting, a private tea, Harry spoke briefly to royal watchers outside. When asked how his father was doing, he said, "He’s great, thank you," according to the New York Post. 

The 40-year-old returned to the U.K. on Sept. 8 to support key causes and charities. He also paid tribute to his grandmother, Queen Elizabeth II, on the third anniversary of her death, visiting her grave in Windsor and laying flowers.

CLICK HERE TO SIGN UP FOR THE ENTERTAINMENT NEWSLETTER

The meeting between father and son is significant. Sources close to Harry previously told People magazine that Charles, who was diagnosed with an undisclosed form of cancer in 2024, was not answering his calls or letters. Royal experts told Fox News Digital that Harry and his brother, Prince William, heir to the British throne, are not on speaking terms.

In May of this year, Harry told the BBC that he wanted to reconcile with his family.

"I would love reconciliation with my family. There’s no point in continuing to fight anymore," Harry told the outlet. "I don’t know how much longer my father has."

Fox News Digital's Stephanie Nolasco and The Associated Press contributed to this report.