Threat Actors Use ChatGPT to Deploy AMOS InfoStealer on macOS

A new investigation by the Kroll SOC and Threat Intelligence Team has uncovered a sophisticated malware delivery campaign targeting macOS users.

Threat actors are now leveraging the growing public trust in artificial intelligence to distribute the AMOS InfoStealer.

The campaign utilizes Google Ads to direct victims to what appears to be a legitimate ChatGPT session, tricking them into executing malicious commands under the guise of fixing a technical issue.

The investigation revealed that the initial infection vector relies heavily on social engineering. Attackers purchased Google Ads to position their malicious links at the top of search results.

Unlike previous campaigns that often relied on typo-squatted domains or fake websites, this campaign utilized the legitimate ChatGPT domain.

This tactic significantly lowered user suspicion, as the guidance appeared to come from a trusted AI source.

Victims who clicked the ad were presented with a ChatGPT conversation that offered a solution to a common technical annoyance: a sound issue on Mac devices.

The AI “assistant” instructed the user to copy and paste a specific command into their macOS terminal to resolve the glitch. However, this command was not a fix but a malicious script designed to download and install the AMOS InfoStealer.

Technical Analysis and Execution

Once the user executes the command in the terminal, the malware initiates the infection chain.

The script acts as an ingress tool, downloading the AMOS payload from an external server. AMOS (Atomic macOS Stealer) is a potent information stealer capable of harvesting sensitive data, including system information, browser passwords, cookies, and crypto wallet details, which are then exfiltrated to the attacker.

Kroll researchers noted that the command line provided in the chat is a known Indicator of Compromise (IOC) for AMOS.

The seamless blend of technical exploitation and social engineering highlights a dangerous evolution in threat tactics.

By framing the attack around a relatable problem and using a reputable platform, attackers successfully bypassed the skepticism users typically apply to traditional phishing attempts.

MITRE ATT&CK Techniques

The following table outlines the specific adversarial tactics and techniques observed during the analysis of this campaign:

ID	Technique	Description
T1204	User Execution	The user is tricked into performing actions that execute the malware.
T1204.002	Malicious File	The user is convinced to download and run a malicious file.
T1204.003	Malicious Command	The user is convinced to execute a malicious command via the terminal.
T1566	Phishing	The AI chat interaction serves as a social engineering vector.
T1071	Application Layer Protocol	Malware is downloaded over HTTP/HTTPS protocols.
T1105	Ingress Tool Transfer	Tools or malware are transferred from an external system to the victim.
T1059	Command and Scripting Interpreter	The attack utilizes shell scripts (Bash/Zsh) for execution.

During the investigation, Kroll attempted to replicate the attack by inputting the same prompt “Follow this method to get your Mac sound working again” into ChatGPT.

In the controlled test, the AI refused to generate the malicious output, instead providing standard safeguarding messages warning against running unsafe instructions.

The attackers then shared this manipulated session via Google Ads, presenting it as a trusted solution.

This discrepancy suggests that the threat actors managed to bypass the AI’s safety guardrails, manipulating the context or using “jailbreak” prompts to force the model to generate the malicious command.

This incident underscores the critical need for users to exercise caution, even when interacting with trusted platforms.

As AI tools become integral to daily workflows, they also become prime targets for abuse, requiring heightened awareness and proactive security controls to prevent compromise.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.