Microsoft Excel “Shared Document” cred harvester featuring multi-attempt password capture, aggressive anti-analysis code, and a Supabase-backed campaign backend.

Analysis of a multi-stage AMOS/Camelot macOS stealer delivered via Google Ads → fake Homebrew page on Google Sites.