Between June and August 2025, a malware campaign identified as SHAMOS, a variant of Atomic macOS Stealer (AMOS) linked to the cybercriminal group COOKIE SPIDER, attempted to compromise over 300 environments but was successfully blocked by the CrowdStrike Falcon platform. This campaign utilized malvertising to target users searching for macOS-related issues, redirecting them to malicious websites. Victims were primarily located in multiple countries including the U.S., UK, Japan, and Canada, while the campaign avoided targeting individuals in Russia due to local forum regulations against commodity malware operations.