Threat actors can deploy a platform-specific credential-stealing infostealer through deceptive Terminal instructions in shared AI chatbot conversations.

On 12 December 2025, news reports revealed how cybercriminals have exploited Google search results to direct macOS users towards malicious AI-generated conversations that deliver the Atomic macOS Stealer (AMOS), a credential-harvesting malware.

Security researchers had identified this tactic after investigating an AMOS detection, tracing it back to searches like “clear disk space on macOS”.

Those queries had surfaced deceptive AI chats from platforms such as Grok and ChatGPT, featuring seemingly helpful Terminal commands that had triggered infections.​

Attack mechanism

The attack unfolds through prompt engineering, where threat actors manipulate AI models to output step-by-step guides disguised as legitimate cleanup or installation tutorials.

For instance, shared ChatGPT links present polished instructions that hide the manipulative back-and-forth, leading users to execute base64-encoded commands. These decode to remote bash scripts initiating a multi-stage payload: it grabs credentials, elevates privileges, and embeds persistence mechanisms, all without alerting macOS defenses. The approach mirrors prior campaigns using fake GitHub pages for phony macOS tools or bogus OpenAI browser setups, blending SEO manipulation with paid ads to mimic organic results.​

Attackers leverage AI sharing features — public conversation links or curated screenshots — to create trustworthy facades. Also:

  • They boost visibility via sponsored Google ads, which blend seamlessly with genuine entries, or organic ranking tricks.
  • Victims searching routine queries encounter these traps, paste the commands blindly, and compromise their systems, as no file downloads or reviews interrupt the process.
  • The command-line approach evades browser safeguards, enabling unrestricted payload execution.​

Experts urge the public to counter such threats by avoiding sponsored search results entirely, given their repeated ties to malware.

This operation underscores vulnerabilities in AI-assisted search ecosystems, where legitimate tools amplify sophisticated social engineering. By abusing trusted interfaces, attackers target macOS users with low-friction infections, emphasizing vigilance over automation in system maintenance.