Reddit User Describes Avoiding Mac Scam After Clicking Deceptive Google Search Result

A Reddit user shared an experience of encountering a scam through a Google search result on the r/MacOS forum. The user, identified as Questionaccount2022, was attempting to create a Google profile for a business when the incident occurred. The post included screenshots of a sponsored result that directed to a URL with the misspelled domain 'goolge' and a pop-up requesting verification steps.

The user described clicking the first link seen in the search results due to being unfocused and multitasking. The verification process involved running a command, which the user initially thought was an anti-AI CAPTCHA method. In a comment, the user noted that dyslexia contributed to the oversight.

Scam Mechanics and Response After the site prompted for an administrative password, the user identified red flags and restarted the Mac without providing the password.

This action prevented further access. Commenters on the post suggested it resembled a Clickfix scam, a type of malware attack, and advised changing passwords, enabling two-factor authentication, and wiping the device. The user followed the recommendations, including wiping the Mac and securing over 500 accounts accumulated over 15 years.

Approximately 48 hours after the incident, no further issues were reported. The user stated that avoiding the password prompt likely prevented data exfiltration.

User Background and Advice In a message to Newsweek, the user identified as a tech worker in his late 20s living in the United States.

The user acknowledged not paying close attention and copying the provided command without full verification. The scam exploited muscle memory and the placement of the sponsored ad. The user recommended verifying all command line inputs and not trusting top Google search results without checking.

The incident involved a type of attack known as AMOS infostealer, which has targeted Mac users for the past two years. This malware can steal personal data and bypass passwords and two-factor authentication. Newsweek contacted Google for comment via email but received no response by the time of reporting.