The infamous AMOS stealer is back in the news, this time using a rather novel and terrifyingly simple technique to trick users into installing malware on their Macs.
As the use of AI advances, black hat hackers are leveraging these tools in innovative new ways. This new campaign speaks to the trend. Here’s how cybercriminals are using ChatGPT and Grok to reach Mac users.
Shareable links on ChatGPT and Grok can be used to spread malware
Recently, Huntress reported a rare new encounter with AMOS in the wild. The company said that while this new AMOS stealer did all the things the old version did, including stealing your data, stealing your crypto, creating a backdoor, and remaining hidden on your Mac, they could not determine how exactly it got into the breached device.
The company first looked for phishing emails, ClickFix lures, and trojan software impersonation downloads. They found none of these. But what they did find was shocking.
Shield your Mac from Atomic Stealer
Cybercriminals had created a set of simple IT instructions for Mac users on Grok and ChatGPT that bypass all security guardrails. Then they created a shareable link of that conversation and promoted those ChatGPT and Grok links on Google.
The result? When Mac users Googled “How to clean my Mac disk space” or other similar IT Apple device queries, they were directed to shareable ChatGPT and Grok links that contained malicious code.
The way cybercriminals promoted these shareable public AI chat links was through Search Engine Optimization (SEO) techniques and sponsored ads, as seen in the image below.
A reminder of what AMOS can do if it gets onto your Mac
The AMOS variant in this campaign has the same capabilities as others seen in the wild.
AMOS can:
- Empty crypto wallets: AMOS looks for popular wallet apps like Electrum, Exodus, MetaMask, Ledger Live, Coinbase Wallet, and others you might have installed.
- Steal browser info: AMOS grabs saved passwords, cookies, autofill details, and login sessions from Chrome, Safari, Firefox, and other browsers.
- Snoop on Keychain: This stealer digs into the macOS Keychain to pull app passwords, Wi-Fi login credentials, and security certificates.
- Hunt for files: It scans your Mac for wallet files, settings, and other sensitive documents.
- Send it all out: AMOS then packs up everything it finds and quietly sends it off to servers controlled by the attacker.
How hackers created a public shareable link on ChatGPT and Grok
To show how easy it is to create shareable links on AI platforms and raise awareness on the risks of public AI shareable links, we recreated the steps hackers took to create these AMOS AI links.
ChatGPT has evidently been updated to mitigate this new technique, as the screenshots below will show. However, bypassing these guardrails, as numerous reports explain, is not that difficult and only takes some convincing.
Reports show that cybercriminals usually trick and jailbreak AI platforms by telling them they are a cybersecurity researcher or developer and need to “run some cybersecurity tests.”
In this new AMOS campaign, black hat hackers first asked the AI platforms to create a set of simple instructions for common macOS IT queries, such as “Clean my disk space on a Mac,” as the image below shows.
Next, all they did was click on the “Share” button, found below the AI’s answer.
Once the hackers clicked on “Share,” the AI gave them a public, cloud-hosted link that looked legitimate—because it is.
Shareable links are stored on ChatGPT.com and hosted on OpenAI public servers, making them convincing. The average user would never suspect that these instructions contained a malicious payload.
As mentioned above, ChatGPT has been updated to mitigate this threat, so when we asked it to replicate the malicious set of instructions that cybercriminals created in this AMOS campaign, it refused. It also added warnings the next time we asked for instructions.
This is obviously good news. Users want companies like OpenAI and XAI to train and update their models according to the latest cybercriminal threats.
How to protect yourself from the AI-ClickFix lure
Other than the new methods outlined above, the rest of the Atomic attack chain and the AMOS stealer malware code are the same.
This technique may sound sophisticated, but it is not new. It is a variation of a ClickFix lure. The only difference is that this ClickFix technique—where criminals give you a set of instructions to follow on your Mac—is that these instructions are hosted on globally recognized AI platforms. This makes the lure highly convincing because most users trust ChatGPT.com (or Grok) and, by extension, a link that includes their name.
The bottom line? Do not click on sponsored ads, and do not click on shareable links even if they are listed on a Google result page. As long as you don’t, this campaign will have nothing on you.
As Fergal Glynn, AI Security Advocate and Chief Marketing Officer at Mindgard, told us, “The share feature on AI platforms poses risks of prompt injection attacks.”
The share feature on AI platforms poses risks of prompt injection attacks.
Fergal Glynn, AI Security Advocate and Chief Marketing Officer at Mindgard
“There are risks of bypassing email security,” Glynn added. “Your credentials may be harvested, you may be fed with disinformation, or there is a risk of your data being exposed permanently. Attackers prepare conversations that show you only portions while hiding their manipulations.”
ClickFix instructions, whether they are hosted on an AI server, hosted on a normal website, sent via email, or pop up on your computer or browser, usually contain a coded script that hackers ask you to paste into your terminal. Sometimes, they even offer simpler instructions, such as “click and drag.”
Both of these methods bypass your Mac’s security guardrails and tell your Mac that it is safe to download a specific payload. This payload will then unbundle with the AMOS stealer.
“Execute Terminal commands only after verifying them properly,” said Glynn. “To save yourself from your credentials being stolen, use password managers.”
“Legitimate Apple staff don’t request you use shady base64 commands, so if it feels suspicious, trust your instinct,” Glynn added.
Finally, use strong antivirus software like Moonlock to prevent AMOS from infecting your Mac and remove it if your Mac has already been infected.
Final thoughts
AMOS, and the other half a dozen new macOS stealers in the wild, all rely on social engineering to hack your computer. By staying updated on what the new vectors of malware distribution are—in this case, AI shareable public links—you can shut down the entire attack chain.
Disclosure note: We asked xAI, the developer of Grok, for their thoughts on this new AMOS technique, what they thought about the entire situation, and if they had any advice for the Mac user community. Their response was, “Legacy Media Lies.” If that’s an anagram, we are still trying to figure it out.
This is an independent publication, and it has not been authorized, sponsored, or otherwise approved by Apple Inc. Mac and macOS are trademarks of Apple Inc. ChatGPT is a trademark of OpenAI.
