Threat Actors Weaponize ChatGPT and Grok Conversations to Deploy AMOS Stealer
## ChatGPT and Grok Conversations Exploited for Malware Distribution
ChatGPT and Grok Conversations Exploited for Malware Distribution
Threat actors are utilizing AI platforms, such as ChatGPT and Grok, to distribute the Atomic macOS Stealer (AMOS). A campaign identified by Huntress on Fri, Dec 5, 2025, shows attackers using legitimate AI services to host malicious payloads.
Users searching for troubleshooting advice, like "Clear disk space on macOS," are directed to high-ranking results on legitimate domains, including chatgpt.com and grok.com . Unlike traditional SEO poisoning, these links lead to actual conversations on OpenAI and xAI platforms.
Upon clicking, users see a professional-looking guide instructing them to execute a command in the macOS Terminal, purportedly to clear system data.
Huntress' analysis reveals that the command executes a base64-encoded script downloading a variant of the AMOS stealer. The malware uses a "living-off-the-land" technique, employing the dscl utility to validate the user's password silently, and sudo -S to gain root privileges.
Category Indicator / Behavior Context
Persistence /Library/LaunchDaemons/com.finder.helper.plist A hidden executable was dropped in the user's home directory.
Threat actors are utilizing AI platforms, such as ChatGPT and Grok, to distribute the Atomic macOS Stealer (AMOS).
File Path /Users/$USER/.helper Used to validate captured credentials without GUI prompts silently.
File Path /tmp/.pass Temporary file used to store the plaintext password during escalation.
Command dscl -authonly <username> Used to silently validate captured credentials without GUI prompts.
Command sudo -S Used to accept the password via standard input for root access.
Network LaunchDaemon is created for persistence. Known C2 URL for the initial payload delivery (Base64 decoded).
This campaign exploits "behavioral trust" rather than technical vulnerabilities. It circumvents defenses like Gatekeeper because users authorize the Terminal command.
Security teams should monitor for unusual osascript execution and dscl usage, especially with curl commands. Users are advised that legitimate AI services will not request execution of encoded Terminal commands for maintenance tasks.
The misuse of trusted AI domains for hosting introduces a challenge for defenders, who must now scrutinize traffic to these platforms for malicious patterns.
Based on reporting by Cyber Security News.