AI-Powered Search Delivers MacOS AMOS Stealer
Researchers Stuart Ashenbrenner and Jonathan Semon at Huntress recently demonstrated that Google search can surface AI-linked content which directs macOS users to run obfuscated Terminal commands. Those commands use curl and base64-encoded scripts to install the AMOS stealer, capture passwords, and place payloads in user folders, bypassing macOS quarantine and signature protections. The report warns that promoted AI responses can be manipulated to distribute malware via poisoned AI conversations.
Key Points
- 1Demonstrated that promoted AI search responses deliver obfuscated Terminal commands installing AMOS stealer
- 2Exploit bypasses macOS protections by using curl and base64 to avoid quarantine and signatures
- 3Advise distrust of promoted AI answers and validate commands before running in Terminal
Scoring Rationale
Credible, widely applicable Huntress research exposing AI-poisoned search, but extends existing social-engineering tactics rather than introducing a wholly new vector.
Sources
Public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems