Hackers Are Using Shared AI Chats to Steal Your Passwords and Crypto

Cybersecurity: Malvertising Campaign Targeting macOS Users

A recent malvertising campaign has been identified, exploiting shared chat features of ChatGPT and DeepSeek to deliver credential-stealing malware specifically targeting macOS users. Threat actors are leveraging sponsored Google search results to redirect users to seemingly legitimate chat sessions, which contain obfuscated malicious commands designed to bypass platform safety mechanisms.

The attack initiates when users search for common macOS troubleshooting queries, such as "how to clear storage on Mac." Sponsored search results then direct users to ChatGPT and DeepSeek chat links, which appear benign but embed malicious terminal commands disguised as system maintenance instructions. These commands are encoded in base64 to avoid initial detection and maintain plausible deniability.

Upon execution, the initial bash script creates a password prompt loop resembling legitimate macOS authentication, validates the entered password using dscl checks, and stores the credentials in /tmp/.pass. The script subsequently downloads a primary malware payload, a native macOS binary intended to steal sensitive data and maintain persistence.

Analysis of the downloaded payload reveals it is Shamus, an info-stealer and cryptostealer malware employing advanced obfuscation techniques to avoid reverse engineering. The shared chat instructions include commands for terminal execution to clean up Mac memory.

The malware uses a multi-stage decoding process combining arithmetic operations with XOR encoding and a custom Base64-like decoder. This approach hinders simple string extraction tools from revealing its capabilities during static analysis. If executed, the malware performs environment checks to detect analysis sandboxes or virtualized environments; if detected, it exits without executing its payload.

The primary payload is an 800-line AppleScript that systematically extracts sensitive data. It targets 12 Chromium-based and Firefox-based browsers to steal cookies, browsing history, login credentials, and local storage data. Notably, the malware targets over 200 cryptocurrency wallet browser extensions, such as MetaMask , and extracts entire extension directories and IndexedDB data. It also targets desktop wallets across 15 applications, including Bitcoin Core, Electrum, Exodus, Ledger Live, and Trezor Suite.

Furthermore, the malware harvests the complete macOS Keychain database, system information via system_profiler, Telegram session data, OpenVPN profiles , and files from Desktop, Documents, and Downloads folders with specified extensions.

For persistence, the malware installs a LaunchDaemon running as root, executing a persistence agent that runs the bot binary every second with user privileges, ensuring it survives system reboots. Additionally, the malware performs application trojanization, replacing legitimate cryptocurrency wallet applications with compromised versions to intercept transactions and steal cryptocurrency, even when hardware wallets are used.

The command and control infrastructure communicates via HTTP POST requests, packaging stolen data into ZIP archives for exfiltration using curl with custom headers.

Organizations should educate users on the risks of clicking sponsored search results, implement endpoint detection and response solutions to identify malware execution patterns, and monitor for suspicious macOS LaunchDaemon installations.

Based on reporting by GBHackers.