AMOS infostealer delivered through Google ads and poisoned ChatGPT/Grok lures
Malware Activity
Summary
Hide ▲
Show ▼
The AMOS infostealer is being distributed through Google search ads that steer macOS users into poisoned ChatGPT and Grok conversations, creating a fresh path to credential theft and remote execution risk. The lure disguises malicious steps as helpful troubleshooting guidance. Victims who follow the commands can end up downloading and running the malware with root-level privileges. The campaign matters because it combines trusted search, legitimate AI chat surfaces, and a macOS-focused infostealer to increase success against everyday users.
Related Happenings
CrashStealer macOS information stealer activity
Malware Activity
H score10
First: 13.07.2026 20:36
Last: 13.07.2026 20:36
Sources 1
About this happening:
CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
CrashStealer macOS information stealer activity
Malware ActivityAbout this happening: CrashStealer is a macOS information-stealing malware that was tracked in May and seen in attacks in early July. It impersonates Apple's crash-reporting tool by...
ClickFix mitigation guidance for Windows and macOS
Defensive Guidance
H score34
First: 30.06.2026 15:00
Last: 30.06.2026 15:00
Sources 1
About this happening:
Organizations are being urged to harden defenses against ClickFix on Windows and macOS, reducing the chance that social-engineering lures can turn trusted dialogs into...
ClickFix mitigation guidance for Windows and macOS
Defensive GuidanceAbout this happening: Organizations are being urged to harden defenses against ClickFix on Windows and macOS, reducing the chance that social-engineering lures can turn trusted dialogs into...
MacOS.Gaslight AI-analysis evasion malware
Malware Activity
H score22
First: 25.06.2026 19:23
Last: 25.06.2026 19:23
Sources 1
About this happening:
The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
MacOS.Gaslight AI-analysis evasion malware
Malware ActivityAbout this happening: The macOS.Gaslight malware family now embeds prompt injection strings and fake system-failure messages to confuse AI-assisted malware analysis tools, risking aborted o...
Gaslight macOS implant with Telegram C2 and prompt-injection payload
Malware Activity
H score29
First: 25.06.2026 12:23
Last: 25.06.2026 12:23
Sources 1
About this happening:
A previously undocumented macOS implant named Gaslight combines Telegram bot API C2, persistent shell control, and file exfiltration with a built-in prompt-i...
Gaslight macOS implant with Telegram C2 and prompt-injection payload
Malware ActivityAbout this happening: A previously undocumented macOS implant named Gaslight combines Telegram bot API C2, persistent shell control, and file exfiltration with a built-in prompt-i...
MacOS.Gaslight Rust infostealer-backdoor with Telegram Bot API channel
Malware Activity
H score30
First: 24.06.2026 17:00
Last: 24.06.2026 17:00
Sources 1
About this happening:
Researchers identified macOS.Gaslight, a North Korea-linked Rust infostealer-backdoor that can steal Chrome, Brave, Firefox and Safari data, terminal histories, in...
MacOS.Gaslight Rust infostealer-backdoor with Telegram Bot API channel
Malware ActivityAbout this happening: Researchers identified macOS.Gaslight, a North Korea-linked Rust infostealer-backdoor that can steal Chrome, Brave, Firefox and Safari data, terminal histories, in...
Timeline
-
11.12.2025 01:50 2 articles · 7mo ago
Kaspersky spots AMOS campaign via poisoned ChatGPT and Grok guides
Initial DisclosureKaspersky researchers first spotted a ClickFix campaign that abuses Google search ads to steer macOS users into poisoned ChatGPT and Grok conversations, and Huntress later confirmed widespread poisoning across troubleshooting queries such as "how to clear data on iMac" and "free up storage on Mac." The lure sends users to a base64-encoded URL that decodes into a bash script named update, shows a fake password prompt, and can download the AMOS infostealer with root-level privileges on macOS.
Show sources
- Google ads for shared ChatGPT, Grok guides push macOS infostealer malware — www.bleepingcomputer.com — 11.12.2025 01:50
- Google ads for shared ChatGPT, Grok guides push macOS infostealer malware — www.bleepingcomputer.com — 11.12.2025 01:50