Hackers Abuse ChatGPT, Claude, and Grok Pages to Spread FakeAgent, AMOS Malware

·2 views

Threat actors are exploiting trusted AI platforms including Claude Artifacts, ChatGPT, and Grok shared pages to distribute malware targeting both Windows and macOS users. On Windows, sponsored Bing ads lead victims to a legitimate-looking Claude Artifact that redirects them to a fake Claude Desktop installer, which deploys SectopRAT via DLL side-loading. On macOS, attackers use fake Apple Support pages on Claude Share and spoofed disk-cleanup guides in ChatGPT and Grok search results to trick users into pasting malicious Terminal commands. These commands deploy multi-stage loaders including MacSync and AMOS, which steal browser credentials, Keychain data, SSH keys, and cryptocurrency wallet information. Security researchers at Huntress confirmed infections across multiple organizations, rating the threat as high severity due to the abuse of user trust in reputable AI-sharing infrastructure.

Read the full story at DEV Community

This is an AI-generated summary. ShortSingh links to the original source for the complete article.

Discussion (0)

How Poor People Buy Cars

Article URL: https://abio.substack.com/p/how-poor-people-buy-cars Comments URL: https://news.ycombinator.com/item?id=49667762 Points: 9 # Comments: 0

0 comments Read more at Hacker News

ProgrammingDEV Community ·

Developer Builds Custom Log Viewer After Outgrowing Frontail's Limitations

A self-taught developer grew frustrated with repeatedly SSH-ing into his server just to check application logs managed inside Tmux sessions. After discovering Frontail, a lightweight browser-based log viewer, he initially found it met his basic needs for streaming logs with simple authentication. However, Frontail fell short when he needed to monitor multiple projects, assign readable aliases, and share individual log stream links. Attempts to extend Frontail's functionality with ChatGPT-assisted configurations quickly revealed the tool was not designed for such use cases. This prompted him to define a new checklist for an ideal log viewer and begin searching for a more flexible, developer-friendly alternative.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GoldFactory Malware Clones Banking Apps via Android Work Profiles to Steal Funds

A high-severity Android malware campaign, linked to the threat group GoldFactory, has been targeting Indonesian users by tricking them into sideloading a malicious APK disguised as an airline, tax, or government application. Once installed, the malware Gigabud harvests banking credentials and screen lock codes, then deploys a secondary tool called Vwork to create an Android Work Profile on the victim's device. Vwork clones the victim's legitimate banking app inside this isolated Work Profile, allowing attackers to register it as a new device with the bank without triggering existing risk signals. Operating behind a black screen overlay, attackers remotely control the cloned app to carry out unauthorized fund transfers that victims are unlikely to notice in real time. Group-IB, which published its findings on September 11, 2026, confirmed actual financial losses and recommends restricting sideloading, limiting accessibility permissions via MDM policies, and strengthening bank-side authentication for newly registered devices.

0 comments Read more at DEV Community

ProgrammingDEV Community ·

GitLab Patches Critical CVSS 10.0 Path Traversal Flaw Exploited Within a Day

GitLab has disclosed a maximum-severity path traversal vulnerability, CVE-2026-85706, affecting self-managed Community and Enterprise Edition instances. The flaw resides in the commit API and allows unauthenticated attackers with network access to read arbitrary files on the server by manipulating the file.path parameter. Active scanning targeting vulnerable instances was observed just one day after public disclosure. Successful exploitation could expose credentials stored in configuration files or logs, potentially enabling unauthorized access to repositories, CI/CD pipelines, and integrated cloud services. GitLab has released patched versions 19.1.8, 19.2.6, and 19.3.2, and urges administrators to update immediately and rotate any secrets that may have been exposed.

0 comments Read more at DEV Community