Hackers Leveraging LLM Shared Chats to Steal Your Passwords and Crypto
A recent malware campaign has been identified that exploits legitimate AI platforms to distribute malicious code to users.
A recent malware campaign has been identified that exploits legitimate AI platforms to distribute malicious code to users.
Attackers are leveraging sponsored Google search results to redirect users searching for common macOS troubleshooting advice, like "how to clear storage on Mac," to fraudulent ChatGPT and DeepSeek shared chat links. These chats appear legitimate and offer system instructions, but they embed hidden malicious commands to compromise systems.
The attack initiates when users access a shared chat that seemingly offers instructions for clearing storage space on their Mac. However, within these steps are base64-encoded commands that download and execute a multi-stage malware program.
The malware circumvents typical AI platform safety checks, enabling attackers to deliver malicious instructions through official channels. The infection process begins with a bash script that masquerades as a credential verification prompt, asking users to enter their system password. The malware then uses this password to gain elevated privileges and download its main binary from attacker-controlled servers.
A recent malware campaign has been identified that exploits legitimate AI platforms to distribute malicious code to users.
Security analysts from Breakpoint Security have identified this malware sample as Shamus, an information stealer and cryptocurrency thief known in security communities.
The malware employs advanced encoding and detection evasion techniques, such as arithmetic and XOR encoding with a custom 6-bit decoder, to hide its code from analysis tools. This makes it challenging for researchers to ascertain its functionality through static analysis.
After installation, the malware establishes persistent system access by creating a LaunchDaemon to run at startup, ensuring continued access after system restarts. It targets sensitive data, including browser cookies and passwords from Chrome, Firefox, and other Chromium-based browsers.
The malware also targets cryptocurrency wallets, specifically focusing on 15 desktop and hardware wallet applications, such as Ledger Live, Trezor Suite, and Bitcoin Core. Additionally, it steals the macOS Keychain database, Telegram session data, VPN profiles, and files from the desktop and Documents folders.
Collected data is compressed and sent to the attacker's servers using encrypted communications, highlighting the sophisticated nature of this malware distribution method. This campaign demonstrates the evolving tactics of threat actors to bypass security measures and compromise user systems.
Based on reporting by Cyber Security News.