MalwarePublished 10 Dec 2025Updated 9 Jan 2026

AI-Poisoning & AMOS Stealer: How Trust Became the Biggest Mac Threat

Source AlienVault OTX General

Description

A sophisticated malware campaign exploits user trust in AI platforms to deliver the AMOS stealer. Attackers use SEO poisoning to surface malicious ChatGPT and Grok conversations offering 'helpful' macOS disk cleanup advice. These conversations contain Terminal commands that, when executed, deploy AMOS, a multi-stage malware that harvests credentials, escalates privileges, and establishes persistence. The attack bypasses traditional security measures by leveraging legitimate platforms and user behavior, making it particularly insidious. AMOS targets cryptocurrency wallets, browser data, and system information, exfiltrating sensitive data to attacker-controlled servers. This campaign represents a significant evolution in social engineering techniques, exploiting the growing reliance on AI assistants for technical guidance.

Impact

For European organizations, the AMOS stealer campaign poses a significant risk particularly to those with macOS endpoints and users who rely on AI assistants for technical support or troubleshooting. The malware’s ability to harvest credentials and browser data can lead to unauthorized access to corporate accounts, email, and internal systems. Its targeting of cryptocurrency wallets is critical for organizations or individuals involved in digital asset management, potentially resulting in financial theft. Privilege escalation and persistence mechanisms allow attackers to maintain long-term access, increasing the risk of further lateral movement and data exfiltration. The campaign’s reliance on user execution of Terminal commands means that employees unaware of the threat may inadvertently compromise their systems. The use of legitimate AI platforms to deliver malicious content complicates detection and response, potentially delaying incident identification. This threat could disrupt business operations, lead to data breaches, and cause reputational damage. Additionally, the campaign’s novel social engineering approach may inspire similar attacks targeting other platforms or operating systems, increasing the overall threat landscape in Europe.

Defensive guidance

1. Implement strict user education programs emphasizing the risks of executing unverified Terminal commands, especially those sourced from AI platforms or online forums. 2. Deploy endpoint security solutions with behavioral detection capabilities that can identify suspicious privilege escalation and persistence activities on macOS. 3. Monitor network traffic for communications with known malicious IPs and domains associated with AMOS (e.g., 45.94.47.186, sanchang.org). 4. Restrict or audit the use of Terminal commands on corporate macOS devices through application control or endpoint management policies. 5. Encourage users to verify AI-generated technical advice through official or trusted IT support channels before execution. 6. Use multi-factor authentication and strong credential management to limit the impact of credential theft. 7. Regularly update macOS and security tools to ensure the latest protections are in place. 8. Implement anomaly detection for unusual access to cryptocurrency wallets or browser data. 9. Establish incident response plans that include AI-based social engineering attack scenarios. 10. Collaborate with threat intelligence providers to stay updated on emerging indicators and tactics related to AI-poisoning campaigns.

Indicators of compromise

Domains 2

sanchang.org
wbehub.org

URLs 1

http://putuartana.com/cleangpt

IP addresses 2

45.94.47.186
45.94.47.205

Hashes 5

276db4f1dd88e514f18649c5472559aed0b2599aa1f1d3f26bd9bc51d1c62166
340c48d5a0c32c9295ca5e60e4af9671c2139a2b488994763abe6449ddfc32aa
68017df4a49e315e49b6e0d134b9c30bae8ece82cf9de045d5f56550d5f59fe1
ab60bb9c33ccf3f2f9553447babb902cdd9a85abce743c97ad02cbc1506bf9eb
e1ca6181898b497728a14a5271ce0d5d05629ea4e80bb745c91f1ae648eb5e11

Community reviews

Loading reviews…