Cyberattack uses fake ChatGPT ads to deploy remote access malware

Cybersecurity researchers from Huntress and Island have identified a sophisticated phishing campaign using fake ChatGPT advertisements to distribute malware. Attackers are purchasing Google Search ads that direct users to legitimate-looking domains, such as chatgpt.com, to exploit user trust.

Once on the site, users encounter a fraudulent bot named ‘fake ChatGPT Plus 5.6’. The bot claims the servers are busy and directs users to an alternative site where they are prompted to prove they are human. This process involves clicking a verification button that automatically copies a malicious code to the user's clipboard. If the user executes this code via the Run or PowerShell commands, a NetSupport Remote Access Trojan (RAT) is installed.

Once the Trojan is active, attackers gain extensive control over the victim's computer, including the ability to view the screen in real-time, activate the webcam and microphone, and steal files, passwords, and banking data. The campaign is noted for its ability to leverage legitimate infrastructures like Google Ads and official OpenAI domains to bypass user suspicion.