Ankura CTIX FLASH Update - October 21, 2025

Malware Activity

Targeting macOS Users and Cryptocurrency Ecosystems

Recent cyber threats have evolved to target different digital environments with sophisticated methods. For instance, on macOS, hackers are deploying fake websites mimicking popular platforms like Homebrew, LogMeIn, and TradingView. The websites trick users into executing malicious commands in Terminal which leads to malware infections such as AMOS and Odyssey. These malicious programs are designed to steal sensitive information, including passwords, cryptocurrency data, and personal files. They are secretly collecting and sending data to remote attackers. Malware gains root access, manipulates system processes, and remains hidden to avoid detection. Meanwhile, a North Korean threat group has adopted a novel tactic called EtherHiding. EtherHiding involves embedding malware within blockchain-based smart contracts. This approach leverages the decentralized and pseudonymous nature of blockchain to