Threat Actors Weaponize ChatGPT, Grok and Leverages Google Ads to Distribute macOS AMOS Stealer

Cybercriminals are leveraging shared AI chatbot conversations on ChatGPT and Grok, boosted by paid Google ads, to promote step-by-step “troubleshooting” instructions that trick macOS users into pasting malicious Terminal commands (the "ClickFix" technique). Those commands download and install the Atomic macOS Stealer (AMOS), which harvests browser passwords, Keychain credentials, crypto wallet seed phrases, and personal files while installing a persistent backdoor; defenders should monitor for unsigned apps requesting passwords, unusual Terminal activity, and unexpected network connections.