# AI-Poisoning & AMOS Stealer: The Biggest Mac Threat

SEO-poisoned ChatGPT/Grok conversations surfaced by Google tricked a macOS user into pasting a Terminal command that installed AMOS stealer, harvested credentials, escalated to root, and persisted.

- Payout: Real-world hack
- Severity: high
- Program: macOS
- Credited: Huntress
- Disclosed: 2025-12-09
- Write-up quality: 7/10
- Original: https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust
- Library page: https://bugbountylibrary.com/r/blog%3Ahuntress-com-blog-amos-stealer-chatgpt-grok-ai-trust
- Tags: domain:desktop impact:ato impact:data-leak impact:funds-loss kind:incident platform:threat-intel sev:high tech:llm technique:recon vuln:privilege-escalation vuln:secrets-leak

**Target:** macOS endpoint via Terminal one-liner from poisoned ChatGPT/Grok shared conversations
**Root cause:** Attackers created legitimate shared AI conversations containing base64-encoded curl|bash commands, then SEO-poisoned common troubleshooting queries so Google ranked them top. macOS Gatekeeper does not inspect shell one-liners, so no warning fires.
**Steps:**
1. Victim searches `Clear disk space on macOS`; Google surfaces top-ranked chatgpt.com and grok.com shared conversations.
2. Conversation instructs user to paste a Terminal command containing a base64 blob decoding to `hxxps://putuartana[.]com/cleangpt`.
3. Loader `update` runs bash, prompts for 'System Password', validates via `dscl -authonly <user> <pass>`, writes to `/tmp/.pass`.
4. Loader pipes password: `cat /tmp/.pass | sudo -S <cmd>` to gain root, curls new `update` to `/tmp`, strips quarantine xattr, chmod +x, runs anti-VM check.
5. Drops ad-hoc signed Mach-O to `~/.helper`; overwrites `/Applications/Ledger Wallet.app` and `Trezor Suite.app` with trojanized bundles that re-prompt for seed phrase and POST to attacker server.
6. Stages data in `/tmp/out.zip` and exfiltrates to C2 `45.94.47[.]186` / `wbehub[.]org`.
7. Persistence: `/Library/LaunchDaemons/com.finder.helper.plist` runs `.agent` AppleScript watchdog that every second checks `/dev/console` and relaunches `.helper` via `sudo -u` in the GUI user context.
**How found:** Huntress triaged a routine AMOS alert with no phishing email, installer, or ClickFix lure; absence of expected delivery vector prompted them to interview the victim, who revealed the Google search and ChatGPT conversation. They then reproduced poisoned results across query variants.
**Exploitation:** No exploit of a software flaw; abuse of trust chain. Attacker hosts real shared AI conversations on chatgpt.com/grok.com with copy-paste Terminal commands, SEO-poisons high-volume queries, and relies on Gatekeeper not scanning shell one-liners. Victim self-executes; loader silently validates password with dscl, escalates via sudo -S, deploys stealer and trojanized wallet apps, exfiltrates keychain, browser creds, and wallet seeds.
**Escalation:** Single password prompt reused for root via sudo -S; GUI-context watchdog persistence survives kills/reboots; trojanized Ledger/Trezor apps escalate to crypto seed theft.
**Insight:** When a stealer alert shows no download/installer artifacts, check shell history and browser history for copy-pasted one-liners from AI chat or forum pages; attackers now host payloads inside legitimate shared-conversation URLs on trusted AI domains and SEO-rank them for mundane queries, so Gatekeeper never sees a quarantined file.