Amos and Lumma crypto malware is being distributed via Reddit posts

Airdrop Is Live 🔥 CaryptosHeadlines Media Has Launched Its Native Token CHT. Airdrop Is Live For Everyone, Claim Instant 5000 CHT Tokens Worth Of $50 USDT. Join the Airdrop at the official website, CryptosHeadlinesToken.com


Lumma and AMOS crypto-stealing malware has recently been distributed via Reddit posts. These posts target Windows and Mac users in the crypto space. 

Such posts use various tactics to trick the user into downloading infected software. However, one lure is becoming particularly common – a cracked version of TradingView. 

A scam post on Reddit tricking users into downloading crypto-stealing malware. Source: MalwareBytes

These scammers have recently been lurking on crypto-related subreddits. According to their posts, the so-called cracked version of TradingView is totally free, and it has been cracked directly from an official version. The scammers claim that it would unlock premium features such as advanced charting tools for stocks, forex, crypto, and commodities. 

Malwarebytes noted that both Windows and Mac files of the infected software are double-zipped. The final zip file is password-protected, which is unusual, as legit executable files are not compressed like that. 

According to Malwarebytes, on Mac, user data gets exfiltrated through a POST request to a server (45.140.13.244) hosted in Seychelles.

The Mac installer features a newer AMOS variant. It is a popular stealer for macOS, and it checks the presence of a virtual machine. If detected, the program exists with error code 42. 

The Windows version loads the payload through an obfuscated bat file that runs a malicious script. Malwarebytes linked the Windows version to a host ‘cousidporke[.]icu’ registered in Russia a week ago.

Cryptopolitan Academy: Coming Soon – A New Way to Earn Passive Income with DeFi in 2025. Learn More



Source link