Attackers exploit ChatGPT and Google ads to spread AMOS infostealer targeting macOS users

Attackers Weaponize ChatGPT Conversations Through Google Ads

A sophisticated malvertising campaign is leveraging the trust users place in ChatGPT and other AI chatbots malware to distribute the AMOS infostealer, a dangerous strain of macOS malware that targets sensitive data and cryptocurrency wallets. Cybersecurity researchers at Huntress and Kaspersky discovered that threat actors are purchasing Google ads malware placements to promote publicly shared conversations on legitimate platforms, directing victims to execute malicious terminal commands disguised as helpful troubleshooting instructions 1

1

2

2

.

The attack represents a dangerous evolution in social engineering tactics, exploiting user trust in established brands to bypass macOS security protections. When users search for common queries like "clear disk space on macOS" or "how to delete system data on Mac," sponsored search results malware links appear at the top of Google results, directing them to ChatGPT or Grok conversations hosted on legitimate LLM platforms 4

4

.

How the ClickFix Campaign Delivers Infostealer Malware on macOS

The ClickFix campaign begins with attackers creating seemingly helpful conversations on ChatGPT and Grok about macOS troubleshooting topics. These conversations contain AI-generated malicious commands presented as safe system cleanup instructions. Huntress researchers reproduced these poisoned results across multiple variations, confirming this isn't an isolated incident but a deliberate, widespread poisoning campaign targeting common troubleshooting queries 1

1

.

When victims execute the provided commands in Terminal, a base64-encoded URL decodes into a bash script that loads a fake password prompt dialog. Once the password is provided, the script validates, stores, and uses it to execute privileged commands, downloading the AMOS infostealer and executing the malware with root-level privileges 1

1

. The attack bypasses traditional red flags because victims don't download files or click suspicious links—they only trust Google and ChatGPT, platforms they've used before or heard about constantly 2

2

.

AMOS Infostealer Targets Cryptocurrency and Sensitive Data

AMOS was first documented in April 2023 as a malware-as-a-service operation that rents the infostealer for $1,000 per month, targeting macOS systems exclusively. Earlier this year, AMOS added a backdoor module that lets operators execute commands on infected hosts, log keystrokes, and drop additional payloads 1

1

.

Once installed, AMOS is dropped as a hidden file (.helper) in the user directory. The malware scans for cryptocurrency wallets including Ledger Wallet, Trezor Suite, Electrum, Exodus, MetaMask, Ledger Live, and Coinbase Wallet. When found, it overwrites legitimate wallet applications with trojanized versions that prompt victims to enter their seed phrase for supposed security reasons 1

1

. The infostealer also targets browser data including cookies, saved passwords, autofill data, and session tokens, as well as macOS Keychain data containing app passwords and Wi-Fi credentials 5

5

.

Persistence is achieved through a LaunchDaemon running a hidden AppleScript that acts as a watchdog loop, restarting the malware within one second if terminated 1

1

.

Why This Cybersecurity Threat Matters

This campaign demonstrates how threat actors exploit trusted AI platforms to conduct data exfiltration attacks that circumvent traditional security awareness training. The attack's effectiveness lies in its ability to weaponize the credibility of Google Ads, ChatGPT, and Grok simultaneously. Users are primed to trust what these sources tell them, making them vulnerable to executing commands they don't fully understand 2

2

.

Kaspersky noted that even after reaching these manipulated conversations, a simple follow-up question asking ChatGPT if the provided instructions are safe to execute reveals that they aren't 1

1

5

5

. This suggests users should verify any technical instructions through additional queries before execution. Security experts recommend never pasting commands into Terminal or browser URL bars without absolute certainty about their function, especially when they request elevated privileges or come from sponsored search results 3

3

5

5

.