Attacks on founders and consultants have grown past phishing emails. They now show up as live LinkedIn intro calls. This post breaks down a fake podcast guest invitation built to install Atomic macOS Stealer (AMOS) on Apple computers.
It covers how the trick works, how attackers hide behind lookalike domains, and the red flags to watch for, so you can protect your passwords and your crypto assets.
_____________________________________________________________
Quick Answers – Jump to Section
- It Started with a Flattering Invitation
- Then the Call Took a Strange Turn
- What the Link Really Did
- The Part That Stings
- The Pattern (How to Spot It)
- What to Do If You’re Targeted
- Final Thoughts
- Frequently Asked Questions
__________________________________________________________
It Started with a Flattering Invitation
A connection messaged me on LinkedIn. His profile looked legit. He had over 500 connections and a believable job title. He said he was working with Blockworks on a new podcast about people’s own crypto stories, nothing to do with work or markets. Was I interested?
I thought it would be a good opportunity to share my experience from 2022, when my crypto account was drained by thieves who stole my iPhone. I agreed to be a guest.
It sounded completely plausible. It is the kind of offer many founders and consultants say yes to. So we booked a call.
__________________________________________________________
Then the Call Took a Strange Turn
When I joined, he was not there. A woman was on the line instead. That was red flag number one.
We started talking. Within two minutes, she told me to click a specific link to start the recording session properly.
I told her we were already on a working call.
Her reply: “No, we can’t host it on Google.”
That one sentence is the whole scam. We were already connected on a platform that worked fine, yet I was told it was not good enough.
__________________________________________________________
What the Link Really Did
I was curious enough to look at the URL, but careful enough not to click it. Instead, I ran the domain through a security check.
The landing page claimed my meeting software was out of date and pushed an automatic download.
It was malware. Specifically, it was Atomic macOS Stealer, also called AMOS. It is built to empty your Keychain, grab browser passwords, copy session cookies, and drain crypto wallets.
Here is what I found:
- Domain: mefex[.]space
- Age: registered about six weeks earlier
- Hosting: hidden behind Cloudflare and privacy proxies
- Threat level: high, and flagged in Security Alliance reports alongside the lookalike domains mefex[.]app, mefex[.]me, and mefex[.]online
Attackers burn and swap these lookalike domains as soon as researchers flag them. Wallet drains are the prize.
__________________________________________________________
The Part That Stings
Earlier that same morning, I had been updating key email passwords in my Mac’s Keychain.
If I had clicked that download button, AMOS could have taken every saved password at once. I would have had no warning until accounts started to fall.
That is the core danger of modern social engineering. The first step looks routine. You run one file, and then a fake system window asks for the password that opens everything.
Security researchers have documented AMOS showing exactly this kind of fake prompt, so a password request after you open something unexpected is a warning, not a formality.
__________________________________________________________
The Pattern (How to Spot It)
This campaign targets business owners, agency founders, web3 creators, and consultants. It uses your public credibility against you.
| Attack stage | What the attacker does |
|---|---|
| 1. First contact | Sends a warm, flattering LinkedIn invite to be a podcast guest |
| 2. Building confidence | Books a real intro call to lower your guard |
| 3. The pivot | Pushes you off Zoom or Google Meet and onto a custom link |
| 4. The payload | Prompts a “required update” download |
In my case, they said they were working with Blockworks, a real crypto media company, and borrowed its branding, so a quick background search looked fine. We have no evidence that Blockworks was involved.
Watch for these red flags:
- The host you booked is missing from the call
- You are asked to leave a working platform within minutes
- A page says your meeting software needs an update
- The link uses an odd domain that looks nearly right
- A window asks for your Mac password after you opened a file you did not expect
__________________________________________________________
What to Do If You’re Targeted
Never install a custom meeting app to join a call you did not set up. Real media outlets and podcasts use Zoom, Google Meet, or Riverside. No real host needs custom software for a basic interview.
If this lands in your inbox:
- Do not click the link or download any files.
- Screenshot the full conversation as a record.
- Report and block the account on LinkedIn right away.
- Do not engage or call them out. Replying confirms your account is active and can put you on a target list.
If you already downloaded a suspicious file, disconnect your device from the network right away. Do not type your Mac password into any window that appeared after you opened it. Reset your passwords from a clean machine, and audit your system.
Small teams often skip basic protections too, and the security habits small crypto teams tend to skip make a handy checklist.
__________________________________________________________
Final Thoughts
I caught this because I was suspicious early and had the tools to check the URL before opening it. Many busy founders do not get that buffer. You are jumping between tasks, the invite is flattering, and the link looks harmless.
The threat has changed. Real attacks are no longer sitting in your spam folder. They hide inside friendly meeting invites and casual chats. Know what to look for before one lands in your inbox.
If you get a message like this, report it to LinkedIn and tell a colleague. A two-minute warning can save someone their accounts.
__________________________________________________________
Frequently Asked Questions
What is Atomic macOS Stealer (AMOS)?
AMOS is malware built to target Apple computers. Once it runs, it takes saved browser passwords, auto-fill data, macOS Keychain passwords, system files, and crypto wallet extensions. Many versions show a fake system dialog that asks for your Mac password, so it can open the Keychain. BleepingComputer and Picus Security describe this behaviour.
Why do attackers use fake podcast invitations?
Flattery and professional networking lower your guard. Founders and consultants are used to booking guest interviews, so attackers use live calls to add pressure and push you to click a bad meeting link.
How do I verify that a podcast host is legitimate?
Cross-check the host and producer on official company channels or verified social profiles. Real podcast producers record on standard platforms like Zoom, Google Meet, Riverside, or SquadCast. They never demand a custom download to join a call.
What should I do if I already clicked a suspicious meeting download link?
Disconnect your device from Wi-Fi and the network right away. Use a separate, clean device to change your passwords, especially email, financial, and crypto accounts. Then revoke active web session tokens and run a full malware sweep or system wipe.
_________________________________________________________________
Download your free copy of the Growth Engine Blueprint here and start accelerating your leads.
Want to know how we can guarantee a mighty boost to your traffic, rank, reputation and authority in you niche?
Tap here to chat to me and I’ll show you how we make it happen.
If you’ve enjoyed reading today’s blog, please share our blog link below.
Do you have a blog on business and marketing that you’d like to share on influxjuice.com/blog? Contact me at rob@influxjuice.com.
Latest Blogs
- AI Fatigue in B2B Outbound: Where Web3 and FinTech Buyers Draw the Line
- ElevenLabs Review (2026): ElevenAgents, ElevenAPI and ElevenCreative Explained
- Emergent Agentic Vibe Coding Platform: The Complete Guide to Building Apps Without Code
- How Stablecoin B2B Projects Are Using Thought Leadership to Build Confidence With Enterprise Buyers in Europe
- What’s Making AI Impact Difficult to Measure for Marketers?
