Fake ChatGPT Site Spreads Malware Through Google Ads

Key Takeaways

• A new malvertising campaign is actively distributing malware to both Windows and macOS users through a fake ChatGPT download site.
• Threat actors are leveraging Google Ads and convincing OpenAI branding to trick users searching for legitimate AI tools.
• The malicious installers deploy sophisticated trojans that use obfuscation, CAPTCHA-based evasion, and PowerShell for staged payload delivery and persistence.
• The campaign highlights the evolving threat of malvertising, which targets users with high intent, making traditional detection methods less effective.

Cybersecurity researchers have uncovered a sophisticated malvertising campaign that capitalizes on the immense popularity of OpenAI’s ChatGPT. This operation utilizes sponsored search results to promote a weaponized, fraudulent download site, subsequently infecting both Windows and macOS users with malware.

Sophisticated Impersonation and Distribution

The campaign, identified by Evalian’s SOC team, meticulously mimics OpenAI’s official branding to entice users actively seeking legitimate AI tools. Attackers deploy convincing search engine advertisements that direct unsuspecting individuals to a malicious domain, openew[.]An app, designed to closely resemble an authentic ChatGPT download page.

Upon arrival, victims are presented with several download options, including installers for Windows and macOS, as well as a Chrome extension. While the browser extension merely redirects to a legitimate listing, likely to build initial trust, the Windows and macOS installers deliver trojanized payloads.

Further investigation revealed that the malicious domain was recently registered through Namecheap and resolves to the IP address 144[.]172[.]104[.]205. This IP address is hosted on RouterHosting infrastructure, a provider frequently associated with short-lived malicious campaigns.

Windows Payload Analysis

The Windows payload, distributed as Chat_GPT.exe (SHA256: 56CC26E88C064B0C423AA8AD6530E58F91D1E4D28FAB1A8BCEDEF16A6582B4D2), employs an Inno Setup installer to deploy an Electron-based application. Despite its deceptive appearance, the binary exhibits several inconsistencies, including mismatched metadata and a code-signing certificate issued to an unrelated entity, F.F.A.P. Hurkmans Beheer B.V. This tactic underscores a common strategy where valid signatures are exploited to bypass user suspicion, without guaranteeing the software’s legitimacy.

Static analysis of the application indicated that it bundles a Chromium-based runtime alongside an obfuscated JavaScript payload, stored within the app.asar file. A significant script, identified as winter.js, contains heavily obfuscated logic, utilizing encoded strings and dynamic execution patterns to hinder straightforward analysis. The application also integrates Node.js modules such as child_process, fs, and systeminformation, suggesting capabilities for comprehensive system reconnaissance, file manipulation, and command execution.

Evasion and Persistence Techniques

Dynamic analysis revealed that the malware incorporates CAPTCHA-based gating prior to executing its core functionality, a sophisticated technique designed to evade automated sandbox detection. Once a user completes the CAPTCHA, the malware initiates multiple PowerShell processes with execution flags such as “-ExecutionPolicy Unrestricted.” This behavior points to a staged payload delivery mechanism, where commands are injected at runtime rather than being statically embedded, further complicating detection efforts.

The malware establishes persistence by creating a Chromium-style profile in %AppData%Satoshi, where it stores data like cookies and cache files. This, combined with event-driven execution, indicates that the malware deliberately delays its primary actions until specific user interactions occur, making it even harder to detect. Intriguingly, the embedded network configurations reference legitimate DNS-over-HTTPS services, including Cloudflare and Google. This strategy allows the malicious traffic to blend seamlessly with normal encrypted DNS traffic, obscuring command-and-control communications and bypassing traditional network monitoring tools.

macOS Variant and Evolving Threats

The macOS variant (SHA256: 7E5B708F6659B1FAD3AAE7B589A706434FBF21708AEEC5AF5910189B96E25FEF) largely evaded detection by antivirus engines at the time of its discovery. This suggests either a low distribution volume or the implementation of highly effective evasion techniques. The overall campaign exemplifies how threat actors are refining malvertising strategies by combining trusted branding, modern application frameworks like Electron, and layered evasion techniques, including obfuscation, CAPTCHA validation, and staged execution.

Unlike traditional phishing, malvertising targets users with high intent, which significantly increases the effectiveness of the initial compromise. For defenders, key indicators of compromise include unexpected Electron applications spawning scripting engines, mismatched installer metadata, and unusual directories such as %APPDATA%Satoshi.

What You Should Do

• Verify Download Sources: Always download software directly from official vendor websites. Be extremely cautious of sponsored search results and third-party download sites, even if they appear legitimate.
• Inspect Digital Signatures: Before running any executable, check its digital signature. While not foolproof, mismatched metadata or unknown signers are red flags.
• Enable Behavioral Monitoring: Implement endpoint detection and response (EDR) solutions that monitor process behavior rather than relying solely on signature-based detection. Look for unusual activity like Electron apps spawning PowerShell processes.
• Educate Users: Conduct regular cybersecurity awareness training to inform users about the dangers of malvertising, brand impersonation, and the importance of verifying download sources.
• Monitor Network Traffic: Implement advanced network monitoring to detect anomalies, even if traffic is encrypted. Pay attention to unusual DNS queries or connections to newly registered domains.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.