LLMShare Campaign Uses Fake ChatGPT Outage Pages to Deliver Malware
Summary
The LLMShare campaign uses Google ads and a fake outage notice hosted in a legitimate chatgpt[.]com shared page to direct users to cloaked Windows and macOS installers at openew[.]app. The final payloads are unclear.
Key points
- Push Security says Google ads direct people searching for ChatGPT to a malicious page shared through a legitimate chatgpt[.]com URL.
- The page displays a fake outage notice made with custom HTML and CSS, urging visitors to download the desktop app.
- The download button leads to openew[.]app, a site impersonating OpenAI’s app-download portal that cloaks its content from security platforms.
- The site offers Windows and macOS installers that researchers say install malware; the final payloads are unknown.
- BleepingComputer’s test of the Windows installer on Any.Run found commands that check whether the device is a real computer or a virtual machine.
- Push Security also observed Claude Artifacts used to host ClickFix-style lures that prompt users to execute malicious commands.
Article Details
- Event Type
- Malvertising and social engineering campaign abusing ChatGPT shared pages to direct users to a fake outage notice and malware-distribution site.
- Impact
- Users clicking the download button are sent to a cloaked site offering malicious Windows and macOS installers disguised as the ChatGPT desktop app. The final payloads are unknown. A tested Windows installer ran commands to determine whether the device was a real computer or a virtual machine.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| DOMAIN | openew[.]app | Cloaked fake download site used to impersonate OpenAI’s desktop application portal and deliver malicious installers. |
Vendors
GoogleThreat actors are abusing ChatGPT’s content-sharing feature and Google ads to promote fake OpenAI outage pages that push users toward malware disguised as the ChatGPT desktop app.OpenAIThreat actors are abusing ChatGPT’s content-sharing feature and Google ads to promote fake OpenAI outage pages that push users toward malware disguised as the ChatGPT desktop app.
Products
ChatGPTThreat actors are abusing ChatGPT’s content-sharing feature and Google ads to promote fake OpenAI outage pages that push users toward malware disguised as the ChatGPT desktop app.Google AdsThreat actors are abusing ChatGPT’s content-sharing feature and Google ads to promote fake OpenAI outage pages that push users toward malware disguised as the ChatGPT desktop app.
Tools
ANY.RUNBleepingComputer’s test of the Windows version on Any.Run found that it executes various commands to determine whether the device is a legitimate computer or a virtual machine.urlscan.ioWhen security platforms like URLScan visited the URL, they were shown a harmless AR/VR company website instead.VirusTotalThe website offers both macOS [VirusTotal] and Windows [VirusTotal] downloads that install malware on devices.