ChatGPT share links abused to host fake outage pages to deliver malware
Recorded: May 29, 2026, 7 p.m.
| Original | Summarized |
ChatGPT share links abused to host fake outage pages to deliver malware News Featured California AG sues 23andMe over 2023 breach exposing health data US charges Google security engineer with Polymarket insider trading Charter Communications data breach affects 4.9 million accounts GreyVibe hackers use ChatGPT, Gemini to power cyberattacks ChatGPT share links abused to host fake outage pages to deliver malware California AG sues 23andMe over 2023 breach exposing health data From $5 Attacks to Botnet-Powered Platforms: Inside the DDoS-as-a- Service Market Dutch govt disrupts malware botnet with 17 million infected devices Tutorials Latest How to access the Dark Web using the Tor Browser How to enable Kernel-mode Hardware-enforced Stack Protection in Windows 11 How to use the Windows Registry Editor How to backup and restore the Windows Registry How to start Windows in Safe Mode How to remove a Trojan, Virus, Worm, or other Malware How to show hidden files in Windows 7 How to see hidden files in Windows Webinars Latest Qualys BrowserCheck STOPDecrypter AuroraDecrypter FilesLockerDecrypter AdwCleaner ComboFix RKill Junkware Removal Tool Deals Categories eLearning IT Certification Courses Gear + Gadgets Security VPNs Popular Best VPNs How to change IP address Access the dark web safely Best VPN for YouTube Forums Virus Removal Guides HomeNewsSecurityChatGPT share links abused to host fake outage pages to deliver malware ChatGPT share links abused to host fake outage pages to deliver malware By Lawrence Abrams May 29, 2026 Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. Fake sponsored ChatGPT advertisement Fake outage message Fake ChatGPT download site The Validation Gap: Automated Pentesting Answers One Question. You Need Six. Automated pentesting tools deliver real value, but they were built to answer one question: can an attacker move through the network? They were not built to test whether your controls block threats, your detection rules fire, or your cloud configs hold.This guide covers the 6 surfaces you actually need to validate. Related Articles: ChatGPT Lawrence Abrams Previous Article Post a Comment Community Rules You need to login in order to post a comment You may also like: Upcoming Webinar Popular Stories Charter confirms data breach after ShinyHunters extortion threat Microsoft Defender can now automatically isolate hacked endpoints Windows 11 KB5089573 update released with performance improvements Sponsor Posts AI is a data-breach time bomb: Read the new report #1 MSP Benchmark report 2026: Insights from 1,000+ MSPs on growth, security, artificial intelligence, and key 2026 trends. 33% Rise in Healthcare Credential Theft in 2025: What you need to know Overdue a password health-check? Audit your Active Directory for free Upcoming Webinar Follow us: Main Sections News Community Forums Useful Resources Welcome Guide Company About BleepingComputer Terms of Use - Privacy Policy - Ethics Statement - Affiliate Disclosure Copyright @ 2003 - 2026 Bleeping Computer® LLC - All Rights Reserved Login Username Password Remember Me Sign in anonymously Sign in with Twitter Not a member yet? Register Now Help us understand the problem. What is going on with this comment? Spam Abusive or Harmful Inappropriate content Strong language Other Read our posting guidelinese to learn what content is prohibited. Submitting... |
Threat actors are leveraging the content-sharing features of large language models such as ChatGPT to deploy malware through sophisticated social engineering techniques. This tactic involves creating fake outage pages that exploit users' trust in legitimate services to facilitate the distribution of malicious software. Specifically, the "LLMShare" campaign, identified by Push Security, utilized Google advertisements to direct users searching for ChatGPT to a malicious shared page hosted on chatgpt.com. Upon arrival, users are presented not with a conversation but with a fabricated outage notice claiming the web version is unavailable and instructing them to download the desktop application instead. The novelty of this attack lies in how the fake notice is generated. Unlike traditional phishing, these attackers engineered the outage message using ChatGPT's rendering capabilities, creating custom HTML and CSS that mimic an official notice. This was achieved by publishing the content through a shared chatgpt.com/s/ link, which included controls like "Show code" and "Remix with ChatGPT," confirming that the fake notice was rendered directly from a prompt-generated response. Clicking a download button on this page redirected visitors to a deceptive site, openew[.]app, which impersonated the official OpenAI desktop application download portal. Security platforms attempting to analyze this site, such as URLScan, were successfully cloaked, displaying benign content instead of the malicious payload. This download site offered installers for both macOS and Windows, which were designed to deploy malware onto the user's device. Testing of the Windows version demonstrated that it executes commands to determine the host environment, checking whether the system was a legitimate computer or a virtual machine. The abuse extends beyond ChatGPT, as threat actors have also exploited similar mechanisms across other AI platforms. Researchers observed attacks leveraging Claude Artifacts, Anthropic’s feature for sharing rendered applications and content, to create lures similar to ClickFix, tricking users into executing malicious commands. Historically, these AI platform sharing features have been exploited to distribute malware. Earlier campaigns involved threat actors using Google advertisements to direct users searching for Claude downloads to shared conversations containing malicious installation instructions. Furthermore, other campaigns have abused shared conversations on platforms like ChatGPT and Grok to impersonate software installation guides, instructing victims to execute commands that result in malware installation. Lawrence Abrams, owner and Editor in Chief of BleepingComputer.com, notes the broader context of these activities, highlighting the vulnerability presented by these AI platform sharing mechanisms. |