Mac stealer spread through shared ChatGPT and Grok chats placed atop Google results
Huntress investigated an Atomic macOS Stealer infection on 5 December 2025. The user had searched how to free disk space on a Mac and opened a top-ranked link to a shared ChatGPT conversation made by the attacker. It told the user to paste a Terminal command that installed the stealer, which took the password, gained root and set persistence. A matching shared Grok chat was also listed.
Sources
- Primary: https://www.huntress.com/blog/amos-stealer-chatgpt-grok-ai-trust
- Upstream: Editorial
- Entered by the cybermap.lol editors, with sources on the entry
Defenses for this class of incident
all categoriesAn AI-era incident sits in these classes of the AI-security landscape. The companies below work on that class of problem. This is a taxonomy, not a claim that any of them would have changed this incident.
Vendor data: AI Security Startups Map by Prompt Security (CC BY 4.0), synced daily. startups.prompt.security. Paid placements are labelled Sponsored; HeimWall, which runs this site, is labelled Operator. 451 companies in the directory.
Wrong or missing? Email founders@heimwall.ai. Corrections are logged here, in place. How corrections and takedowns work.