Lifehacker

Malware Spread via ChatGPT Ads Targets macOS Users

First seen 15 Dec 2025, 17:54 UTC • Au.Lifehacker

•30.6

Article Content

Include sub-articles 1 / 1

Browse articles

ThreatCluster

Threat actors are using paid ads on Google to promote misleading conversations with ChatGPT and Grok, which appear to offer tech support but actually lead macOS users to download infostealing malware. This campaign is a variation of the ClickFix attack, utilizing tactics like CAPTCHA prompts and fake error messages to deceive users.

How this analysis works

Attack Flow

10 entities, 8 inferred relationships (STIX 2.1).

Technique (1)

Malware

Organization (1)

Google

Malware (2)

ClickFix
AMOS

Affected Platform (3)

Atlas
ChatGPT
MacOS

Tool (3)

Grok
PowerShell
Terminal

Relationships

ClickFix targets Google
AMOS targets Google
Malware targets Atlas
Malware targets ChatGPT
Malware targets MacOS
ClickFix related to Grok
ClickFix related to PowerShell
ClickFix related to Terminal

Continue Reading

Ghost CMS SQL Injection Exploits 700+ Sites in Ongoing ClickFix Campaign Russian GRU Hackers Use Fake CAPTCHAs to Compromise Ukrainian Users Kimsuky Exploits South Korean Groupware Vendors with New Gomir Variants Rapid7 Reports Surge in Vulnerability Exploitation Outpacing Patching Efforts ACSC Issues Critical Alert on Exploited CMS Vulnerabilities Cybercriminals Exploit BNB Chain for Malware via Fake CAPTCHAs

Malware Spread via ChatGPT Ads Targets macOS Users

Article Content

More articles in this cluster

Attack Flow

Defensive Countermeasures

Extracted Entities

Continue Reading