That top Google result for Homebrew could infect your Mac

2026-03-31

Attackers are buying Google ads to serve a fake Homebrew site above the real one, tricking Mac users into pasting a Base64-encoded Terminal command that installs AMOS (Atomic macOS Stealer), which targets browser credentials and crypto wallets.