Vojtech Moravec at GenDigital details how AMOS can replace Ledger and Trezor apps to steal phrases. The campaign used Google Ads and fake claude.ai pages. https://www.gendigital.com/blog/insights/research/claude-content-sharing-malware