Amos and Lumma crypto malware is being distributed via Reddit posts

Lumma and AMOS crypto-stealing malware has recently been distributed via Reddit posts. These posts target Windows and Mac users in the crypto space. 

Such posts use various tactics to trick the user into downloading infected software. However, one lure is becoming particularly common – a cracked version of TradingView. 

These scammers have recently been lurking on crypto-related subreddits. According to their posts, the so-called cracked version of TradingView is totally free, and it has been cracked directly from an official version. The scammers claim that it would unlock premium features such as advanced charting tools for stocks, forex, crypto, and commodities. 

Malwarebytes noted that both Windows and Mac files of the infected software are double-zipped. The final zip file is password-protected, which is unusual, as legit executable files are not compressed like that. 

According to Malwarebytes, on Mac, user data gets exfiltrated through a POST request to a server (45.140.13.244) hosted in Seychelles.

The Mac installer features a newer AMOS variant. It is a popular stealer for macOS, and it checks the presence of a virtual machine. If detected, the program exists with error code 42. 

The Windows version loads the payload through an obfuscated bat file that runs a malicious script. Malwarebytes linked the Windows version to a host ‘cousidporke[.]icu’ registered in Russia a week ago.