Google Ads Abuse ChatGPT and Grok Guides to Spread macOS Infostealer Malware

Have you ever clicked on a Google Advertisement (Ad) believing it to be credible and useful? Most of us have clicked Google ads like this at some point. Hackers are currently relying on this method to exploit Mac users with bogus ChatGPT and Grok articles to distribute malicious software.

How Do These Scams Function?​

The scam uses a very smart approach. Hackers pay for Google Ads when people are looking for answers regarding common Mac problems, like "How to delete system data from my Mac." The ad directs the user to a fake ChatGPT or Grok (Grok is the slang term used on the internet today for a person who is well versed in a certain area of expertise.) chat service which looks completely legitimate, as well as offers assistance and guidance.

These fake chats provide the user with instructions on how to copy/paste a command line (Terminal) into their Mac's Terminal window. Unfortunately, the command installs the Trojan which allows hackers to access your device without you knowing it. Therefore once you enter this command, your nightmare has just begun!

Then what happens? The command:

• Requests a Mac password
• Uses your password to have total access to your entire system
• Downloads and installs the AMOS infostealer malware
• Stealing all private information stored on your computer

All of this occurs silently, in the background.

What Does This Malware Steal?​

This malware aims to steal important information.

Examples include:

• Browsing history and saved passwords
• Cookies and login sessions
• Wallet keys and cryptocurrency wallets
• Personal documents, computer specifications, etc.

The risk is even higher for people who use crypto applications because this malware has the ability to change legitimate wallet apps to become fraudulent ones. If you enter your recovery phrase into one of these counterfeit wallet apps, you will lose everything.

Why Do People Fall Victim To This Scam?​

This scam works well because it exploits users' trust in well-known brands (Google and ChatGPT). When users see a Google advertisement or an AI guide, they will not consider the possibility of encountering a security threat. You might also have been fooled by this scam. You probably would not have thought twice about running commands.

The Final Point​

If you ever see commands in advertisements or chats from unknown A.I. sources, do not execute them. Also, if you are ever asked for your password, make sure to verify the request first. Being cautious can help protect you from a potentially devastating loss.