When it comes to stealing data or money, hackers need a way into your systems. The very best way to do this is to manipulate a user into clicking a link or inserting their credentials somewhere they shouldn’t. But, what if hackers could trick users into following a set of instructions to install malware straight onto their computer without even realising what they are doing?
Well, this is exactly what happens with these new ChatGPT attacks. In recent months, researchers have uncovered a major new cyber security issue where hackers infiltrate Google search results with AI-generated conversations that look completely legitimate but lead to malware infections.
Unfortunately, it is extremely easy to fall prey to these kinds of cyber attacks as they appear legitimately under sponsored posts on Google. This is called Malvertising and is the advertising of malware (as the name suggests). It is very likely that in the coming years attacks utilising both Google and AI will become even more common.
What is the current ChatGPT hack?
It begins with a straightforward Google search for a common technical problem, for example the search “clear disk space on macOS” recently led to manipulated results. In the sponsored posts, Google lists links to shared AI conversations from platforms like ChatGPT or Grok. These conversations look authentic; they have step-by-step instructions; they have clean formatting and reassuring language; the instructions include terminal commands that look safe. No red flags raised.
In reality, these instructions lead to the downloading and execution of a sophisticated malware. In the specific example above, the malware was called Atomic macOS Stealer (AMOS).
AMOS is designed to:
- Harvest passwords and sensitive data
- Escalate hackers’ privileges silently, behind-the-scenes
- Sit on your systems without triggering security warnings
What makes this type of attack so dangerous is that it can get around basic security settings. There are no suspicious downloads, no pop-up alerts, just the user copying and pasting some text into Terminal and the computer is compromised.
Why is this so dangerous?
Hackers often rely on social engineering to encourage users to give away sensitive information. Historically, attackers might have mimicked an MD's email address to get the finance team to pay fake invoices.
In using trusted tools like ChatGPT and Google, hackers continue this type of social manipulation. This attack is particularly bad because it exploits multiple layers of trust:
- Search Engine Trust – top-ranked results feel safe
- Platform Trust – links point to legitimate domains like chatgpt.com
- Format Trust – instructions look professional and familiar
- Behaviour Trust – copying Terminal commands is common practice for troubleshooting
This is social engineering at its best: the attack looks exactly like the help it impersonates.
How to stay safe
First of all, well done for reading this blog – educating yourself on cyber threats is the first step towards combatting them.
Here are some other practical steps:
- Avoid sponsored search results - Many attacks start with paid ads. Skip them or verify the advertiser using the “About this ad” option.
- Never run commands from unknown sources - Unknown commands can execute anything without your knowledge.
- Use real-time anti-malware protection - You need a solution that is continuously monitoring your devices, there are lots of different types. At Resolve we use a type of software called EDR (Endpoint Detection and Response). It continuously monitors your devices for suspicious activity. For instance, many files being accessed simultaneously or data being accessed from a different country are suspicious activity.
- Be sceptical of AI conversations shared online - If you didn’t start the AI conversation yourself, don’t trust it blindly.
- Act quickly if you suspect infection - If you notice anything suspicious, even if it might seem silly, contact your IT support company immediately.
- Change all your passwords - It is imperative that passwords are changed swiftly to avoid any further attacks. Multi-factor-authentication needs to be in use, along with a password manager.
- Ask your IT provider to consider a clean reinstall of your computer - This involves completely erasing the hard drive, removing the operating system, applications, settings and personal files, and reinstalling everything. Make sure everything you might needs is backed up.
How Resolve can help you
We know about this new form of cyber attack because it happened to one of our customers.
Luckily, they are a Resolve customer with Resolve Cyber Security, which means their systems are continuously monitored, identifying malicious activity before it becomes a problem.
Resolve Cyber Security uses Microsoft Defender, so as soon as the malware infected a machine, the Resolve cyber security team received an alert. We could then quickly get on the machine, block the malware and remove it immediately. The malicious code couldn’t run, and all was well again.
The good thing about Resolve Cyber Security and 24-hr monitoring is that as soon as your computer starts behaving differently, for instance tries to access unusual system files, we will be notified. It also means we know exactly which files were accessed and potentially infected. This was particularly valuable during this kind of cyber attack because the user had unknowingly installed the malware themselves, so it sidestepped other behaviours (like dodgy emails and links) that would usually trigger cyber security defences.
Without a reliable IT partner, the client could have had all their data stolen and sold. It could have resulted in significant downtime for the business, and the data might never have been recoverable.
Obviously, we think proactive cyber security support is vital, and this new kind of cyber attack proves why. To find out more about how we can protect you contact us on 0114 2134 555 or hello@resolve.co.uk
