macOS stealer posing as Loom may be linked to Crazy Evil group

At Moonlock Lab, we’ve recently uncovered a sophisticated and alarming threat spreading through Google-sponsored URLs. The threat, a stealer malware targeting macOS, poses as the popular application Loom, a widely used screen recording tool. Our investigation kicked off when we noticed a Google ad that appeared to promote the official Loom application. At first glance, it looked legitimate, enticing users to click on what seemed to be a trusted source. However, upon clicking the link, things took a nasty turn. … As we dug deeper, it became clear that this campaign was not limited to Loom.

• ‘Poseidon’ Mac stealer distributed via Google ads
• Mac users targeted in new malvertising campaign delivering Atomic Stealer
• Fake Microsoft Teams for Mac delivers Atomic Stealer
• Atomic Stealer distributed to Mac users via fake browser updates