Malicious macOS Apps and AI Chat Platforms Used to Distribute AMOS Malware

Attackers are distributing a fake version of the 'Dynamic Island for Mac' app, which mimics the legitimate application's branding and even reuses its demo video to deceive users. The malicious installer, distributed as a .dmg file (notably named DynamicLake.dmg), instructs users to drag files into the Terminal—a behavior not present in the authentic app. Security firm Jamf has analyzed this malware variant, and affected users have reported difficulties in removing the infection, while abuse reports to platforms like YouTube have so far been ineffective.

Separately, cybercriminals are leveraging trusted AI chat platforms such as ChatGPT and Grok to spread the Atomic macOS Stealer (AMOS) malware. By using SEO poisoning, attackers manipulate search results to direct users to seemingly legitimate AI-hosted guides, which instruct them to run malicious code in the macOS Terminal. This code captures the user's password and installs AMOS, which targets cryptocurrency wallets and harvests sensitive data. Both campaigns exploit user trust in familiar brands and platforms, using social engineering to bypass traditional security defenses and infect macOS systems.