Cybersecurity researchers are warning about an active campaign that uses Google search ads and fake AI chat pages to trick Mac users into installing a dangerous piece of malware known as AMOS, short for Atomic macOS Stealer.
By Gina Hill | Alaska Headline Living | December 2025
If you use a Mac and rely on Google or AI tools for quick tech help, there is a new scam you need to know about. Cybersecurity researchers are warning about an active campaign that uses Google search ads and fake AI chat pages to trick Mac users into installing a dangerous piece of malware known as AMOS, short for Atomic macOS Stealer.
This is not a traditional virus with obvious pop-ups or warnings. Instead, it quietly convinces people to infect themselves, which makes it especially dangerous.
How the Attack Works
Cybercriminals are buying Google search ads targeting common Mac-related queries, such as “how to clear disk space on macOS” or “fix slow Mac.” These ads appear at the top of search results and are designed to look legitimate.
Clicking the ad directs users to fake or poisoned search results that appear to be trustworthy AI chatbot guides hosted on platforms like ChatGPT or Grok. At first glance, the guides offer helpful instructions. However, they contain malicious commands. If a Mac user blindly copies and pastes these commands into their Terminal, the AMOS infostealer malware is installed on the device.
Once installed, AMOS works silently in the background to steal sensitive information, including:
- Login credentials and passwords
- Cryptocurrency wallets
- Browser history and cookies
Infostealers like AMOS are designed to exfiltrate valuable data without the user’s knowledge. The exact impact depends on the malware version and the specific campaign.
Why This Attack is So Effective
This scam succeeds because it relies on trust and authority, not fear. It abuses Google’s advertising system and the credibility of AI platforms to encourage users to take actions that compromise their own computers. Security experts call this a form of social engineering, where criminals manipulate people into executing the attack themselves.
How to Protect Yourself
You can significantly reduce your risk by following these steps:
- Avoid clicking suspicious sponsored ads, especially when searching for technical instructions.
- Verify the advertiser’s name before clicking any Google ad.
- Never paste Terminal commands from search results or shared chats unless you fully understand them.
- Use reputable anti-malware software and ad-blocking tools on macOS to block malicious content.
What to Do If You’re Affected
If you think your Mac has been infected by AMOS or any other malware, take immediate action:
- Run a malware scan using trusted software like Malwarebytes to detect and remove threats.
- Update your passwords for sensitive accounts that could be compromised.
- Contact Apple Support for help cleaning your device and ensuring it is secure. You can reach Apple Support at https://support.apple.com or by calling 1-800-MY-APPLE.
- Report the incident to the Federal Trade Commission (FTC) at https://reportfraud.ftc.gov if your personal information has been stolen.
By following these precautions and taking the right steps if you are impacted, you can greatly reduce the risk of falling victim to this type of cyberattack.
The Bottom Line
This scam is not a result of careless behavior. It reflects how criminals are adapting to how people actually use technology today. Many users trust search engines and AI tools, seeking quick answers without realizing they could be handing over control of their systems.
Being cautious is not paranoia. It is modern consumer protection. Awareness and careful action are the best defenses.
Sources:
