Infostealer has entered the chat
Source Reddit NetSec
Description
A new campaign involving the ClickFix malware is spreading a macOS infostealer by abusing the ChatGPT chat-sharing feature to post malicious user guides on the official ChatGPT website. This technique leverages social engineering by embedding harmful content within seemingly legitimate shared chats, potentially tricking users into downloading and executing the infostealer. Although no known exploits in the wild have been reported yet, the threat is considered high severity due to the sensitive data targeted and the innovative attack vector. European organizations using macOS devices are at risk, especially those with employees who frequently use ChatGPT and may be exposed to these malicious shared chats. The attack impacts confidentiality by stealing sensitive information and could lead to broader compromise if credentials or tokens are exfiltrated. Mitigation requires monitoring and restricting the use of chat-sharing features, educating users about the risks of downloading files from untrusted shared chats, and deploying endpoint detection solutions tailored for macOS. Countries with high macOS adoption and significant tech sector presence, such as Germany, the UK, France, and the Nordics, are more likely to be affected. Given the ease of exploitation via social engineering and the potential for significant data theft, the suggested severity is high.