File-notification systems are designed to help applications know when files or folders change. However, researchers discovered that the information they provide can also reveal useful clues about what a user is doing.

The research was conducted by researchers at Graz University of Technology. Their study, titled “File Notification Attacks: Templating and Exploiting Side-Channel Leakage from the File-Notification Systems on Linux, Windows, and macOS,” explores how these signals can be used as a side channel.

How the File Notification Attack Works

Linux, Windows, and macOS use different technologies to monitor file-system changes. These include inotify on Linux, ReadDirectoryChangesW on Windows, and FSEvents on macOS.

These services are not vulnerabilities by themselves. They are legitimate features used by applications to respond to changes in files and folders.

The problem is that notifications can contain information such as file paths, timing, and activity patterns. By collecting this information and comparing it with previously recorded examples, malicious software can potentially identify what a user is doing.

Researchers created a semi-automated system that records file-system activity while different actions are performed. These recordings can then be used as templates to recognize similar activity later.

The study found that these patterns could reveal activities including terminal commands, keyboard and mouse input, website visits, printing, virtual machines, containers, VPN changes, Bluetooth activity, and USB-device connections.

The monitoring also had a very small effect on system performance, with the researchers measuring CPU overhead of no more than 0.21% in their tests.

Linux and Windows Show Significant Information Leakage

Linux produced some of the most detailed activity signals in the study. Researchers found that an unprivileged user could receive certain file notifications even when they could not directly read the related files.

This information was enough to identify keystroke patterns in testing involving seven users, with F1 scores ranging from 93.1% to 100%.

The researchers also monitored pseudo-terminal activity over SSH and achieved a 100% F1 score in their test scenario. Passwords entered into terminals with input echo disabled were not observable.

On Windows, the researchers found that monitoring the root of the C: drive could expose file paths associated with another user’s profile, even when the monitoring user did not have permission to access those directories.

Browser activity was another concern. File-system patterns created by browser storage could help identify websites visited by a user. In the study, Firefox activity from 975 of the top 1,000 tested websites could be identified, achieving a 97.8% F1 score in the researchers’ test. Edge produced fewer site-specific patterns and achieved a 48.5% F1 score.

macOS Reveals Less, But Still Exposes Activity

macOS provided stronger separation between users because FSEvents does not freely expose private directories belonging to other users.

However, researchers were still able to identify patterns associated with activities such as application launches, system setting changes, printing, network activity, external storage, Bluetooth devices, and virtual machines.

The average notification latency on macOS was around 11.48 milliseconds, making it slower than the other platforms tested. Despite this, researchers said the information could still be useful for behavioral monitoring.

Importantly, this technique is not a remote attack that can compromise a computer over the internet. Malicious software must already be running on the machine as a local, unprivileged user.

That makes the technique more relevant to post-compromise surveillance, where malware already present on a system attempts to gather additional information about the victim.

Researchers Recommend Stronger Protection

The researchers reported their findings to Linux, Microsoft, Apple, and KDE in October 2025.

Linux introduced a partial mitigation for certain device files in early 2026. Microsoft classified the behavior as being by design and provides the EnforceDirectoryChangeNotificationPermissionCheck policy to restrict certain unauthorized path disclosures. The researchers noted that this setting is disabled by default.

The researchers recommend stronger permission checks that clearly separate files a user owns, files they can read, and protected files belonging to others. They also recommend tighter controls on applications that attempt to monitor large sections of the file system.

Organizations can reduce the risk by keeping systems updated, limiting untrusted software, using application sandboxing, separating service accounts, and applying stricter notification permissions where available.

The research highlights an important security lesson: attackers do not always need to read sensitive data to learn something about a user. File paths, timing information, and system notifications can become valuable sources of intelligence when analyzed together.

The post Hackers Exploit File Notifications to Track User Activity appeared first on First Hackers News.

Security researchers at Jamf Threat Labs discovered a fake website that closely resembles GitHub. The page uses GitHub-style branding, including its dark interface, Octocat logo, and a “Verified Publisher” badge, making the download appear legitimate.

The fake site does not provide a normal application download. Instead, users are given a Terminal command and told to copy and paste it into their Mac.

This is a technique commonly known as ClickFix, where attackers convince victims to manually execute commands rather than relying on a traditional malicious download.

How the Attack Works

The attack begins when a user visits the fake GitHub page and follows the installation instructions.

After the command is pasted into Terminal, a script runs in the background and downloads a password-protected archive. The malware then extracts a disguised file, removes macOS security markings, and launches the payload.

The process is designed to look like a normal installation while the malicious activity happens in the background.

Once running, AmnesiaStealer gathers information from the infected Mac and attempts to capture the user’s password through a fake installer prompt.

That password can then be used to access valuable information stored on the device, including:

• Browser data
• Apple Keychain information
• Apple Notes
• Telegram sessions
• Documents
• Other stored credentials

The Browser Session Theft Is the Bigger Concern

AmnesiaStealer has another capability that makes the campaign particularly concerning.

The malware can download an additional component called stream_module when instructed by the attacker. This component copies the victim’s browser profile and launches it in a hidden browser session.

It then connects to the Chrome DevTools Protocol, giving the attacker the ability to interact with the browser remotely.

In practical terms, this could allow an attacker to view the browser session and control actions such as mouse movement, keyboard input, and navigation.

That means an attacker could potentially operate already-authenticated sessions for services such as email, social media, and online banking without necessarily needing to know the victim’s password.

Some macOS Bypass Attempts Are Outdated

Researchers also found that parts of AmnesiaStealer rely on techniques intended to bypass Apple’s security protections.

Several of these techniques were already addressed by Apple in earlier macOS releases. On newer versions, including macOS 26, some of those attempts fail.

However, the malware’s core ability to steal credentials and browser information remains a significant concern.

Why This Campaign Matters

AmnesiaStealer shows how attackers are moving away from obvious malware downloads and instead using social engineering to get users to execute the malware themselves.

The fake GitHub page makes the attack look trustworthy. The Terminal instructions make the victim part of the installation process. Once the malware is running, additional components can be delivered based on the attacker’s instructions.

This combination makes the campaign more difficult for users to recognize as a traditional malware attack.

How Mac Users Can Stay Safe

The most important rule is simple:

Never paste an unknown command into Terminal just because a website tells you to.

Users should also:

• Download software only from trusted sources
• Keep macOS and browsers updated
• Be cautious with unexpected Terminal instructions
• Treat unexpected administrator or password prompts with suspicion
• Use endpoint and browser security protections
• Avoid downloading software from unfamiliar GitHub-style websites

A legitimate-looking website does not necessarily mean a legitimate download.

For macOS users, a Terminal command should always be treated as code—not as an ordinary installation step.

The post New AmnesiaStealer Campaign Targets macOS Users appeared first on First Hackers News.

The campaign shows how threat actors are increasingly abusing legitimate platforms like Google Ads and Claude AI to make malicious content appear trustworthy.

How the Attack Works

The attack begins with a sponsored Google advertisement for Claude Code. When users click the ad, they are taken to a genuine claude.ai page that appears to contain installation instructions.

However, the guide includes a hidden command that downloads malware instead of the legitimate software.

To make the attack harder to detect, the command:

• Uses encoded text to hide its real purpose.
• Silently downloads malicious files.
• Conceals the actual download location.
• Bypasses normal security checks during execution.

Because the page is hosted on a legitimate domain, many users may assume it is safe.

What MacSync Can Steal

Once installed, the MacSync infostealer collects sensitive information from the infected Mac, including:

• Saved passwords and Keychain data
• Browser cookies
• SSH keys
• Cloud service credentials
• Kubernetes configuration files
• Developer tokens
• Telegram session data
• Cryptocurrency wallet information

Researchers also found that the malware can modify Ledger Live, allowing attackers to continue stealing information even after the initial infection.

Why This Campaign Is Dangerous

Unlike traditional phishing attacks that rely on fake websites, this campaign uses real and trusted services to gain users’ confidence.

This makes the attack more convincing because:

• The advertisement appears in Google search results.
• The landing page uses a legitimate Claude AI domain.
• The installation steps closely resemble the official process.
• The malicious command is hidden using encoding techniques.

These tactics make it difficult for users to recognize the threat.

How to Stay Protected

To reduce the risk of infection:

• Download software only from official vendor websites.
• Avoid installing applications directly from sponsored search results.
• Carefully review any terminal commands before running them.
• Keep macOS and security software up to date.
• Use endpoint protection capable of detecting suspicious behavior.

Conclusion

This campaign demonstrates that attackers no longer need fake websites to spread malware. By abusing trusted platforms and disguising malicious commands, they can successfully target users who believe they are following legitimate installation instructions. As these techniques become more advanced, verifying installation sources and carefully reviewing terminal commands are becoming essential cybersecurity practices.

IOCs

The post Cybercriminals Use Fake Claude Code to Spread Malware appeared first on First Hackers News.

The campaign relies on AppleScript files that appear harmless at first glance but secretly execute multiple stages of malware in the background. By using built-in macOS tools, the attackers can avoid several security protections and quietly deploy additional payloads.

How the Attack Works

The infection begins when a user opens a malicious AppleScript (.scpt) file disguised as a software update.

The script displays a large block of harmless-looking text while hidden code runs in the background. Once executed, it uses the curl command to download additional AppleScript payloads from attacker-controlled servers and immediately executes them through osascript.

This multi-stage approach allows attackers to:

• Download additional malware
• Communicate with command-and-control servers
• Establish persistence on the device
• Deploy backdoors
• Harvest credentials
• Collect sensitive information

Researchers noted that this technique helps the attackers bypass several macOS security checks because the execution appears to be initiated by the user.

Credential Theft and Data Collection

The malware includes several components designed to steal valuable information from infected systems.

Capabilities observed in the campaign include:

• Stealing macOS passwords
• Harvesting browser data
• Collecting cryptocurrency wallet information
• Accessing Telegram session data
• Extracting SSH keys
• Gathering Apple Notes data
• Capturing system information
• Uploading stolen files to attacker infrastructure

One component displays a legitimate-looking password prompt to trick users into entering their system credentials. Once verified, the credentials are sent to the attackers.

Researchers also found attempts to manipulate macOS Transparency, Consent, and Control (TCC) settings, allowing the malware to gain broader access to files and applications without generating additional security warnings.

Security Recommendations

Microsoft and Apple have released protections to help detect and block this activity. Apple updated XProtect and Safe Browsing protections, while Microsoft added new detection capabilities to Microsoft Defender.

Security teams are encouraged to:

• Avoid running unsolicited .scpt files
• Verify software updates through official vendor websites
• Monitor suspicious curl and osascript activity
• Restrict execution of unsigned applications
• Watch for unusual TCC database modifications
• Rotate credentials if compromise is suspected
• Use hardware wallets for cryptocurrency storage

The campaign highlights how threat actors continue to abuse trusted macOS tools and social engineering techniques to bypass security controls and gain access to sensitive user data.

Indicators of compromise

Malicious file hashes

The post Sapphire Sleet Targets macOS With Multi-Stage Malware appeared first on First Hackers News.

Researchers from Mysk reported that WhatsApp uses a shared container linked to Meta applications, identified as group.com.facebook.family. On Apple devices, app group containers allow applications from the same developer to share data and resources.

Because Facebook, Instagram, and WhatsApp belong to the same ecosystem, the shared architecture could introduce privacy and security concerns if exploited alongside operating system vulnerabilities.

Shared Containers Raise Privacy Concerns

The researchers found that WhatsApp chat databases stored inside these containers are not encrypted at rest. This means the data may remain readable if attackers gain access to the device or exploit weaknesses in the operating system.

According to the report, the following risks were identified:

• Chat histories may be stored in plaintext
• Other Meta-owned apps could theoretically access shared data
• Users receive no alerts when such access occurs
• The issue affects both macOS and iOS environments

Researchers also demonstrated that WhatsApp chat histories could be extracted from iPhone backups, where the same unencrypted storage structure was observed.

The findings highlight an important distinction in security design. While WhatsApp uses end-to-end encryption to protect messages during transmission, that protection does not automatically secure data stored locally on the device.

macOS Vulnerability Increases Exposure Risk

The risk becomes more serious when combined with a recently disclosed macOS vulnerability tracked as CVE-2026-28910. The flaw affected Apple’s Archive Utility tool and reportedly allowed attackers to bypass App Sandbox protections.

By abusing this vulnerability, attackers could potentially:

• Access protected application containers
• Extract sensitive information from apps
• Bypass Apple’s Transparency, Consent, and Control protections
• Access chat histories from applications like WhatsApp

Researchers presented a proof-of-concept demonstration showing how the vulnerability could be combined with WhatsApp’s storage behavior to retrieve chat data.

Security Debate Around the Findings

Not all experts agree on the severity of the issue. WABetaInfo stated that although the databases may not be encrypted locally, Apple’s sandboxing system still provides strong isolation between applications.

From this perspective, attackers would still require elevated system privileges or a separate operating system exploit to access the stored data.

However, researchers at Mysk argue that shared app group permissions between Meta applications reduce isolation boundaries and increase the potential attack surface.

The discussion highlights broader concerns about local data protection in modern mobile ecosystems, especially when multiple applications share common storage environments.

Recommendations for Users

Security experts recommend several steps to reduce potential exposure risks:

• Enable encrypted Finder or iTunes backups
• Keep macOS and iOS updated with the latest security patches
• Use strong device passcodes and device encryption
• Limit unnecessary applications from the same developer ecosystem
• Regularly review application permissions and backup settings

At the time of reporting, there were no confirmed cases of widespread exploitation linked to the findings. However, the research highlights the importance of protecting sensitive data not only during transmission but also while stored on devices.

The post WhatsApp Chat Data Found Stored Without Encryption appeared first on First Hackers News.

ExifTool is widely used to read and modify metadata in images, PDFs, and multimedia files. Because the tool is heavily integrated into media workflows, automation pipelines, and digital asset management systems, the vulnerability creates a significant security risk in environments that handle untrusted files.

The implications of the ExifTool vulnerability extend to various sectors, where data integrity and security are paramount.

How the Vulnerability Works

The issue is linked to improper sanitization of metadata fields related to file creation dates on macOS. Researchers found that attackers can embed malicious commands inside image metadata fields such as FileCreateDate or DateTimeOriginal.

When ExifTool processes the manipulated file under specific conditions, the hidden command can be executed through the system shell.

The vulnerability becomes exploitable when:

• ExifTool processes raw metadata values using the -n flag
• Malicious metadata is copied through the -tagsFromFile feature
• Unsafe input reaches a system() execution call without proper filtering

Researchers observed that ExifTool internally builds system commands using metadata values extracted directly from files. While most parameters are sanitized, one execution path allowed unfiltered user-controlled data to be passed into a shell command.

This creates a command injection scenario where attackers can run arbitrary commands with the privileges of the user processing the file.

Security Risks and Patch Information

The vulnerability is especially dangerous for organizations using automated image-processing workflows, newsroom environments, or media management platforms where files are processed automatically.

Because the malicious payload is hidden inside metadata, the image itself may appear legitimate and bypass traditional security checks.

If exploited successfully, attackers could:

• Execute malicious commands on macOS systems
• Deploy malware or backdoors
• Steal sensitive information
• Move laterally across internal networks

Researchers from Kaspersky identified the vulnerability, and ExifTool developers addressed the issue in version 13.50.

The patched release changes how system commands are executed by replacing unsafe string-based command construction with safer argument-based execution methods. This prevents shell interpretation and significantly reduces the risk of command injection.

Users and organizations are strongly advised to update to ExifTool 13.50 or later immediately. Security experts also recommend processing untrusted files inside isolated environments such as sandboxes or virtual machines to reduce exposure to malicious media files.

The incident highlights an ongoing cybersecurity challenge where even trusted file-processing tools can become attack vectors if user-controlled input is not handled securely.

The post ExifTool Flaw Allows Mac System Compromise appeared first on First Hackers News.

This activity has been closely analyzed by Mauro Eldritch, who has documented how this campaign is impacting high-value macOS users, especially in fintech and crypto sectors.

Initial Access and Social Engineering Flow

The attack typically begins with targeted outreach on Telegram, where threat actors impersonate trusted contacts such as colleagues or business partners. Victims—often executives or developers—receive urgent meeting requests designed to trigger quick action.

They are then redirected to phishing pages that closely resemble platforms like Zoom, Microsoft Teams, or Google Meet. These pages claim a technical issue and instruct the user to fix it manually.

Instead of a traditional exploit, the victim is guided to copy and execute a Terminal command. Because this action is user-initiated, many security tools interpret it as legitimate behavior.

Execution Chain and Malware Behavior

Once the command is executed, the infection chain unfolds in multiple stages designed to blend in with normal macOS activity.

• The first-stage binary (commonly seen as teamsSDK.bin) acts as a downloader that retrieves additional components
• Fake macOS applications are dropped, mimicking meeting tools or system prompts to appear legitimate
• These apps repeatedly request user passwords, often using poorly written prompts to trick the victim
• A secondary module (such as D1YrHRTg.bin) performs deep system profiling using native tools like sysctl

The profiling stage gathers extensive system intelligence, including host identifiers, operating system details, running processes, network configuration, and browser-related data from Chrome, Safari, Brave, and similar applications.

Interestingly, researchers observed flaws in parts of the malware. Some profiling components enter continuous loops, repeatedly sending the same data to command-and-control infrastructure, which can cause noticeable performance issues on infected machines.

To avoid execution barriers, the malware leverages macOS utilities like codesign to apply ad-hoc signatures, helping malicious binaries run under standard policies without raising immediate suspicion.

Credential Theft and Data Exfiltration

The final stage of the attack is handled by a stealer component referred to as macrasv2. This module focuses on extracting high-value data from the compromised system.

Targets include:

• Browser-stored credentials and active session cookies
• macOS Keychain entries containing saved secrets
• Files that can grant access to SaaS platforms, internal systems, or crypto wallets

All collected data is compressed into archive files (for example, user_ext.zip) and exfiltrated to attacker-controlled servers.

Persistence Mechanism

To maintain long-term access, additional components like minst2.bin are deployed. These create persistence by placing disguised binaries—often pretending to be legitimate services like OneDrive—inside directories labeled as security-related (such as an “Antivirus Service” folder).

The malware then registers itself as a LaunchAgent, ensuring execution every time the user logs in.

Why This Campaign Is Effective

This attack stands out because it avoids traditional exploitation techniques. By relying on user-executed commands and built-in macOS tools, the activity appears normal to many EDR solutions until after credentials and access tokens are already compromised.

For organizations where macOS devices are widely used—especially among developers and leadership—this creates a serious risk. A single compromised system can lead to broader access across internal infrastructure and financial assets.

Detection and Defensive Considerations

To counter this type of campaign, defenders need to shift focus toward behavior rather than just exploits.

• Monitor unusual Terminal activity and command execution patterns
• Identify and block ClickFix-style phishing workflows
• Regularly audit LaunchAgents for suspicious or disguised entries
• Track outbound connections to uncommon ports or Telegram-related infrastructure
• Use sandbox environments like ANY.RUN to safely analyze suspicious files, URLs, and execution chains

Interactive sandboxing plays a key role in understanding how these multi-stage attacks operate, allowing defenders to reconstruct the full infection path and extract indicators for detection.

The post Lazarus Delivers “Mach-O Man” macOS Malware via ClickFix appeared first on First Hackers News.

A recent campaign shows attackers abusing shareable ChatGPT and Grok conversations, then promoting those links through Google Search ads. The goal? Convince macOS users to run Terminal commands that quietly install the Atomic macOS Stealer (AMOS).

This isn’t traditional malware distribution. It’s credibility-based delivery.

The Shift: Malware Hidden Behind Trust

Instead of hosting malware on suspicious domains, attackers are:

• Publishing malicious “how-to” conversations on legitimate AI platforms
• Boosting those pages using Google Ads
• Framing the instructions as helpful troubleshooting steps

For example, a user searching for something harmless like “clear disk space on macOS” may encounter a sponsored AI chat result. The page looks legitimate. The domain is trusted. The instructions appear technical and helpful.

But the recommended Terminal command downloads and executes malicious code.

No fake installer.
No cracked software.
Just copy, paste, and compromise.

The malicious instructions are hosted on legitimate AI domains via public sharing links. That removes the psychological red flag users often rely on.

Paid ads further amplify visibility, placing these AI-hosted pages at the top of search results — sometimes ahead of legitimate support content.

This is social engineering layered with platform trust.

The Target: Cryptocurrency and Browser Data

macOS infostealers like AMOS are part of a growing underground economy. Their primary targets include:

• Saved browser credentials
• Apple Keychain secrets
• Cryptocurrency wallets and seed phrases
• Chrome crypto extensions (over 100 reported targets)
• Wallet-themed phishing tied to brands like Ledger, Trezor, and Exodus

Some operators even advertise affiliate-style revenue sharing for crypto theft, highlighting how organized this ecosystem has become

What defenders should watch for

• Users copying Terminal commands from web pages
• Scripts that download and execute immediately
• Signed apps requesting unexpected permissions
• Unusual outbound traffic to crypto-related infrastructure

The bigger pattern is clear.

Modern macOS attacks don’t rely on obvious red flags anymore.

They rely on trusted platforms, legitimate domains, paid visibility, and signed applications to remove the moment where a user might hesitate.

That’s the shift defenders need to understand.

The post Threat Actors Leverage ChatGPT, Grok, and Google Ads to Deploy macOS AMOS Stealer appeared first on First Hackers News.

Security researchers report that this macOS-focused campaign has reached nearly 50,000 downloads and is backed by a fully operational attack infrastructure.

Malicious VS Code Extensions Identified

Investigators have linked three malicious extensions on the Open VSX marketplace to the same GlassWorm threat actor. All three share common command-and-control infrastructure, including the IP address 45.32.151.157, which has appeared in earlier GlassWorm activity.

This confirms the campaign is coordinated and actively maintained.

What’s New in Wave 4

This fourth wave represents a clear escalation compared to earlier versions.

• Unicode-based hiding techniques have been replaced with AES-256-CBC encrypted payloads
• The encrypted payloads are embedded in compiled JavaScript
• A hardcoded encryption key is reused across all malicious extensions
• Malware execution is delayed by 15 minutes to evade sandbox detection

Most automated security scans stop after five minutes, allowing the malware to execute only after security checks are complete.

Unlike earlier GlassWorm campaigns that targeted Windows systems, Wave 4 is exclusive to macOS.

This shift is strategic. Developers in cryptocurrency, Web3, and startup environments—GlassWorm’s primary targets—largely rely on Apple devices.

The macOS payload is platform-specific and includes:

• AppleScript for execution instead of PowerShell
• LaunchAgents for persistence instead of Registry keys
• Direct theft of data from the macOS Keychain

GlassWorm’s infrastructure continues to evolve to avoid disruption. The threat actor has introduced a new Solana wallet address while keeping older wallets active. The malware queries Solana blockchain transaction memos to retrieve command-and-control URLs, with the data encoded in base64 format.

This blockchain-based C2 mechanism is designed to be decentralized, difficult to takedown, and resistant to traditional disruption efforts. Infrastructure tracking also shows frequent IP rotation and the use of a dedicated exfiltration server.

The most concerning development in this wave is GlassWorm’s move beyond credential theft. The malware now actively targets Ledger Live and Trezor Suite, attempting to replace legitimate wallet applications with trojanized versions.

This capability significantly raises the risk for developers and cryptocurrency users, as it directly threatens hardware-protected digital assets.

Mitigation and Recommendations

A successful attack could allow threat actors to manipulate wallet interfaces, redirect transactions, harvest recovery phrases, and monitor hardware wallet communications, effectively undermining the security guarantees of air-gapped devices.

GlassWorm’s trajectory shows a steady expansion in both capability and ambition. The campaign has moved away from earlier stealth techniques and operating system limitations, now focusing on deeper system integration and higher-value targets.

Current observations show that, as of late December 2025, infrastructure used to deliver compromised wallet components is not yet serving active payloads. This suggests the operation is staged and awaiting the next execution phase.

The malware also enforces strict validation checks during deployment, rejecting unusually small files. This points to careful engineering choices designed to reduce detection and prevent malformed executions.

Overall, GlassWorm represents a responsive and evolving adversary. The operator clearly adapts to public disclosures, refining tools and methods while keeping core infrastructure alive. The threat should be considered ongoing rather than dormant.

‍Follow Us on: Linkedin, Instagram, Facebook to get the latest security news!

The post GlassWorm malware uses malicious VS Code extensions to attack macOS systems appeared first on First Hackers News.

Attackers are using AI chats on OpenAI’s ChatGPT and xAI’s Grok. They push these chats to the top of search results using SEO tricks, making them look like trusted troubleshooting guides.

The danger is that users don’t download anything suspicious. No installers, no malware files, and no warnings. All it takes is searching on Google, clicking a result, and copy-pasting a command.

This attack works by abusing three types of trust: search engines, legitimate platforms, and AI-generated advice.

When users search basic macOS tips like “clear disk space on macOS,” top results lead them to real ChatGPT or Grok pages.

These pages look professional and safe, offering step-by-step instructions.

But when the victim runs the Terminal command, it triggers a hidden multi-stage attack that steals credentials, gains higher access, and sends data out silently.

Exploiting Trust Through AI

This is a major evolution in social engineering. Attackers are not pretending to be trusted platforms anymore—they are turning trusted platforms into weapons using poisoned search results.

The malware doesn’t need to look like safe software when it can pretend to be helpful guidance.

During the investigation, Huntress confirmed similar poisoned results for searches like “how to clear data on iMac,” “clear system data on iMac,” and “free up storage on Mac,” proving this is a broad, intentional campaign—not a one-off case.

The presence of similar campaigns on both ChatGPT and Grok shows that a coordinated attacker is actively targeting these platforms.

The AMOS delivery method makes this even more dangerous. The first command runs a bash script that tricks users into entering their system password for “verification.”

Instead of showing a real macOS login prompt, the script checks the password quietly in the background using the dscl-authonly command—no system dialog, no Touch ID, and no warning.

Once the password is confirmed, the script stores it in plaintext and uses it to gain full admin access through sudo -S without asking the user again.
It then installs the main stealer payload in a hidden .helper folder inside the user’s home directory.
Finally, it replaces genuine crypto wallet apps like Ledger and Trezor with fake versions designed to steal seed phrases.

New AI-Enabled Attack Methods

The stealer quietly gathers data from crypto wallets, browser passwords, the macOS Keychain, and other sensitive files.

Its persistence method is also very stealthy. A LaunchDaemon runs a hidden AppleScript loop that checks the active user every second, keeping the malware running nonstop.

f the .helper malware stops for any reason, the watchdog brings it back almost instantly.
This keeps it running all the time — even after a restart or if someone tries to kill the process — and lets it access user-level passwords and app data that normal background services can’t touch.

For defenders, this attack is difficult to spot. The infection starts with a harmless-looking Terminal command, so signature-based tools see nothing unusual.

Detection now depends on noticing odd behavior: unexpected osascript password checks, strange dscl-authonly activity, hidden files in the home directory, or processes using sudo with piped passwords.

For users, the danger is even more subtle. Nothing feels suspicious. Copying a command from ChatGPT seems normal and helpful — not risky.

As AI becomes part of everyday tasks, this technique will spread fast. It’s easy to scale and hard to block with traditional defenses.

This campaign is a turning point for macOS security. The real shift isn’t AMOS itself — it’s the delivery method that slips past both security tools and human judgment.

Today’s attacks don’t just target machines — they target habits and our growing trust in AI.

The post 𝗔𝗠𝗢𝗦 𝗦𝘁𝗲𝗮𝗹𝗲𝗿 𝗦𝗽𝗿𝗲𝗮𝗱 𝘃𝗶𝗮 𝗔𝗯𝘂𝘀𝗲𝗱 𝗖𝗵𝗮𝘁𝗚𝗣𝗧 & 𝗚𝗿𝗼𝗸 𝗖𝗵𝗮𝘁𝘀 appeared first on First Hackers News.