AMOS Infostealer Malware Campaign Exploiting Google Ads for macOS Users

Recently, a new AMOS infostealer campaign has been discovered, targeting macOS users through a deceptive scheme involving Google search ads. The campaign lures users into engaging with Grok and ChatGPT conversations, promising helpful instructions but ultimately leading to the installation of the AMOS malware on their systems.

Initiated by cybersecurity researchers at Kaspersky and further detailed by the Huntress managed security platform, the ClickFix attack preys on individuals searching for macOS-related topics like maintenance tips, problem-solving techniques, or even specific software such as Atlas – OpenAI’s web browser for macOS.

Victims are directed to Google advertisements that link to ChatGPT and Grok conversations shared publicly in anticipation of the attack. These conversations, hosted on legitimate LLM platforms, contain malicious instructions aimed at installing the malware discreetly.

According to Huntress researchers, the poisoned search results were replicated across various queries related to common troubleshooting tasks, indicating a widespread poisoning campaign targeting unsuspecting users.

If users fall for the ruse and execute the commands provided in the AI chat on their macOS Terminal, a base64-encoded URL decodes into a bash script (update) that initiates a fake password prompt dialog.

Upon entering the password, the script validates, stores, and leverages it to execute privileged commands, including downloading the AMOS infostealer and running the malware with root-level access.

AMOS, identified in April 2023, operates as a malware-as-a-service (MaaS) entity offering the infostealer for rent at $1,000 per month, exclusively targeting macOS systems.

Earlier this year, AMOS introduced a backdoor module enabling operators to execute commands on infected hosts, capture keystrokes, and deploy additional payloads.

AMOS targets a range of cryptocurrency wallets, browser data, macOS Keychain information, and files stored on the system. It establishes persistence through a LaunchDaemon (com.finder.helper.plist) that runs a hidden AppleScript, ensuring the malware restarts within a second if terminated.

These ClickFix attacks highlight the evolving tactics of threat actors, exploiting reputable platforms like OpenAI and X to propagate malicious activities.

Users are urged to exercise caution and refrain from executing commands sourced online, particularly if they lack a complete understanding of their implications.

Kaspersky emphasized that even engaging with manipulated LLM conversations can be risky, as a simple inquiry to ChatGPT about the safety of provided instructions often reveals their malicious nature.

Issues with Identity and Access Management (IAM) extend beyond IT, impacting various aspects of a business.

This comprehensive guide delves into the shortcomings of traditional IAM practices, showcases effective IAM strategies, and presents a checklist for developing a scalable IAM approach.

Get the guide