Poisoned Search Results Lead Mac Users to AMOS Stealer via ChatGPT and Grok
Summary
Huntress traced an AMOS infection to a malicious Terminal command in AI-style troubleshooting chats surfaced by Google. The malware stole credentials and other data, gained root access, and persisted on the victim’s Mac.
Key points
- Huntress reported that a user searching for ways to clear macOS disk space encountered highly ranked ChatGPT and Grok conversations containing malicious cleanup instructions.
- The user copied a Terminal command that fetched a bash script, which prompted for the system password and silently validated it with dscl-authonly.
- The script stored the password in a hidden file and used it with sudo to run commands with root privileges.
- The AMOS payload collected browser credentials, cookies, Keychain data, cryptocurrency wallet information, and sensitive files, then staged data for exfiltration.
- The malware installed a LaunchDaemon and a watchdog loop that relaunched its hidden executable in the logged-in user's session, including after reboots or termination.
- Huntress recommended monitoring for suspicious osascript credential prompts, dscl -authonly use, password-piped sudo commands, and hidden executables in user home directories.
Article Details
- Attack Vectors
- SEO poisoning placed attacker-created ChatGPT and Grok conversations among highly ranked results for routine macOS troubleshooting searches.
- The conversations instructed victims to copy and execute a Terminal command that downloaded a malicious bash script.
- The script requested the victim's system password, silently validated it, stored it in plaintext, and used it with sudo to run privileged commands.
- The loader downloaded and installed the AMOS payload, and could replace Ledger Wallet and Trezor Suite applications with trojanized copies that requested wallet seed phrases.
- A LaunchDaemon and AppleScript watchdog loop relaunched the hidden .helper payload across reboots and user-session changes.
- Defensive Notes
- Monitor for osascript requesting credentials and unusual dscl -authonly usage, especially from user-initiated bash scripts.
- Monitor system_profiler usage related to virtual-machine or emulator detection.
- Audit sudo -u processes and commands that receive passwords through stdin.
- Look for hidden executables in users' home directories and unexpected LaunchDaemons.
- Advise users not to execute Terminal commands from unfamiliar sources and to be cautious of utilities requesting passwords.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]94[.]47[.]186 | Listed as C2 infrastructure for the AMOS campaign. |
| IPV4 | 45[.]94[.]47[.]205 | Listed as Gate infrastructure associated with the AMOS campaign. |
| SHA256 | 276db4f1dd88e514f18649c5472559aed0b2599aa1f1d3f26bd9bc51d1c62166 | Hash of the malicious com.finder.helper.plist persistence file. |
| SHA256 | 340c48d5a0c32c9295ca5e60e4af9671c2139a2b488994763abe6449ddfc32aa | Hash of the first-stage update payload. |
| SHA256 | 68017df4a49e315e49b6e0d134b9c30bae8ece82cf9de045d5f56550d5f59fe1 | Hash of another first-stage update payload. |
| SHA256 | ab60bb9c33ccf3f2f9553447babb902cdd9a85abce743c97ad02cbc1506bf9eb | Hash of the AMOS .helper Mach-O payload. |
| SHA256 | e1ca6181898b497728a14a5271ce0d5d05629ea4e80bb745c91f1ae648eb5e11 | Hash of the malicious .agent AppleScript that relaunches .helper. |
MITRE ATT&CK
T1036.005 · Match Legitimate Resource Name or LocationThe loader can overwrite existing Ledger Wallet and Trezor Suite applications with trojanized copies.T1041 · Exfiltration Over C2 ChannelThe malware stages harvested data in /tmp/out.zip and transmits it to its C2 server.T1059.002 · AppleScriptThe loader and .agent watchdog use AppleScript to install and relaunch the payload.T1059.004 · Unix ShellThe victim-executed command and downloaded first-stage bash script use the Unix shell to deploy AMOS.T1105 · Ingress Tool TransferThe loader downloads the bash script, update binary, and core stealer payload from attacker infrastructure.T1140 · Deobfuscate/Decode Files or InformationThe base64-encoded string in the Terminal command is decoded to reveal the first-stage script URL.T1497.001 · System ChecksBefore deploying the next stage, the malware checks whether it is running in a virtual machine.T1543.004 · Launch DaemonA LaunchDaemon at /Library/LaunchDaemons/com.finder.helper.plist runs the watchdog after reboot.T1548.003 · Sudo and Sudo CachingThe loader pipes the stored password to sudo -S to run subsequent commands with root privileges.T1552.001 · Credentials In FilesThe script writes the victim's validated password in plaintext to /tmp/.pass.T1555.001 · KeychainThe AMOS payload queries macOS Keychain for application passwords, Wi-Fi credentials, and certificates.T1555.003 · Credentials from Web BrowsersAMOS targets saved passwords, cookies, autofill data, and session tokens in browser credential databases.T1564.001 · Hidden Files and DirectoriesThe payload and supporting files use dot-prefixed hidden paths, including .helper and .agent.
People
Malware
Products
ChatGPTHomeBlogAMOS Stealer Exploits AI Trust: Malware Delivered Through ChatGPT and GrokGoogle SearchInstead, what we found was a simple Google search, followed by a conversation with ChatGPT:GrokHomeBlogAMOS Stealer Exploits AI Trust: Malware Delivered Through ChatGPT and GrokLedger WalletThe loader will then look for two applications in the /Applications directory: Ledger Wallet and Trezor Suite.macOSOn December 5, 2025, Huntress triaged an Atomic macOS Stealer (AMOS) alert that initially appeared routine: data exfiltration, standard AMOS persistence, and no unusual infection chain indicators in the telemetry.Trezor SuiteThe loader will then look for two applications in the /Applications directory: Ledger Wallet and Trezor Suite.