AI-Driven Malware Distribution: How Criminals Are Exploiting ChatGPT and Grok to Push AMOS Stealer

In a concerning convergence of generative artificial intelligence and cybercrime, threat actors are now leveraging large language models (LLMs) to distribute the notorious Atomic macOS Stealer (AMOS). According to a December 2025 investigation by Cyber Press, criminals have begun using malicious search engine optimization (SEO) techniques rooted in dialogues generated by ChatGPT and Grok. These poisoned conversations are designed to manipulate search rankings, tricking unsuspecting users into downloading malware disguised as legitimate software. This development marks a significant escalation in the sophistication of malware distribution, targeting a global user base that spans over 120 countries.

The AMOS malware, which targets macOS environments previously considered safer than their Windows counterparts, has evolved rapidly throughout 2024 and 2025. While earlier campaigns relied on malvertising and fake application updates, the integration of AI-generated content to legitimize malicious links represents a new frontier in social engineering. Security researchers warn that this tactic turns the trust users place in AI outputs against them, creating a highly effective vector for data theft.

Timeline of Escalation

The trajectory of the Atomic Stealer demonstrates a persistent and adaptive threat. In January 2024, Malwarebytes observed the initial surge of AMOS via malvertising campaigns. By August 2024, Intego confirmed that variants were being distributed through poisoned Google Ads, where threat actors paid for top placement to mimic popular software.

The situation deteriorated further in late 2024 with the emergence of the "Poseidon" variant, which Malwarebytes reported accounted for 70% of all mac infostealer detections by the end of the year. The capabilities of the malware also expanded; in July 2025, Moonlock (MacPaw's security division) identified a new backdoor feature in AMOS, allowing for persistent access rather than just "smash-and-grab" theft. This culminated in the December 2025 discovery of campaigns exploiting AI dialogues to dominate search results.

Technical Sophistication and AI Exploitation

The core of the recent attacks involves manipulating the algorithms of search engines. By generating coherent, keyword-rich dialogues using tools like ChatGPT and Grok, attackers create web pages that appear authoritative to search engine crawlers. When users search for specific software or troubleshooting advice, these poisoned pages appear at the top of Google results.

"This newly observed campaign... uses malicious search engine optimization to ensure poisoned AI-generated conversations appear as the top results on Google." - Cyber Press, December 2025

SentinelOne analysts noted that throughout 2024, variants of the Amos Atomic family have been "attempting to obfuscate the required AppleScript code in new and inventive ways." This technical obfuscation, combined with the psychological legitimacy provided by AI-generated text, makes detection increasingly difficult for both automated systems and human users.

Global Impact and Corporate Risk

Targeting the Enterprise

The reach of these campaigns is extensive. Reports indicate that AMOS has infiltrated systems in over 120 countries, with significant infection rates in the United States, France, Italy, the United Kingdom, and Canada. The malware is designed to exfiltrate sensitive data, including iCloud keychain passwords, browser cookies, and cryptocurrency wallets.

For businesses, the risk is acute. Trend Micro's analysis of cracked app campaigns highlights that employees attempting to bypass licensing for productivity software often inadvertently invite AMOS onto corporate networks. Once inside, the malware's ability to restore dead cookies-a feature spotted by Cyble in early 2024-allows attackers to hijack active sessions, bypassing multi-factor authentication.

Expert Perspectives on Defense

Cybersecurity experts emphasize that the era of "security through obscurity" for macOS users is effectively over. Picus Security advises organizations to adopt a "layered defense approach" to mitigate these campaigns. This includes moving beyond standard antivirus solutions to endpoint detection and response (EDR) systems capable of identifying behavioral anomalies associated with script execution.

Furthermore, user education is paramount. With Typosquatted domains mimicking providers like Spectrum now in use (as reported by SISA in June 2025), employees must be trained to scrutinize URLs and avoid downloading software from unofficial repositories, even if search results appear to validate them.

Outlook: The AI-Malware Arms Race

The integration of tools like ChatGPT and Grok into the cybercriminal toolkit signals a dangerous shift toward automated, high-quality social engineering at scale. As we move further into 2026, the industry anticipates a rise in "hyper-personalized" malware delivery, where AI constructs unique lures based on a target's online behavior.

Regulators and tech platforms face mounting pressure to detect and flag AI-generated malicious content. However, as noted by SentinelOne, the teams behind Atomic variants are competing with each other for business, driving rapid innovation and evasion techniques. For the foreseeable future, the responsibility will fall heavily on organizations to harden their defenses against an increasingly intelligent digital threat.