Monitor this situation.
Unsubscribe anytime.
[SITUATION] · [QUIET] · [TECHNOLOGY]
3 clusters · 15 sources · 11 days · First seen · Last updated
ChatGPT-themed phishing and malware campaigns
Overview
Security researchers have identified evolving phishing campaigns targeting ChatGPT users to steal credentials and deploy malware.
Initial reports detailed a campaign where attackers impersonated OpenAI through polished emails. These messages used the official ChatGPT logo and claimed subscription payments had been declined, creating urgency by giving recipients a 48-hour window to ‘Update Payment Information’. This method aimed to capture account credentials and sensitive financial data via fraudulent login pages.
Subsequent findings revealed a more sophisticated approach involving fake Google Search advertisements. These ads direct users to deceptive domains that mimic legitimate sites. Once on these pages, users encounter a fraudulent bot, ‘fake ChatGPT Plus 5.6’, which directs them to an alternative site for human verification. This process involves a malicious script that copies code to the user’s clipboard. If the user executes the code via PowerShell or Run commands, a NetSupport Remote Access Trojan (RAT) is installed, granting attackers control over the victim’s computer.
More recently, researchers uncovered a human-operated campaign expanding its scope to include other AI tools such as Google Gemini, Claude, Perplexity, and Meta Muse. This operation specifically targets ad account managers and media buyers by promising services like campaign optimization or spend audits. The attackers utilize a ‘browser-in-the-browser’ (BitB) technique, where a fake browser window is drawn inside a legitimate one to spoof trusted domains like accounts.google.com. This allows attackers to trick victims into providing credentials and multi-factor authentication (MFA) codes, enabling them to spend account balances on fraudulent ads or resell access.
In this human-managed operation, attackers monitor login attempts and fingerprint devices in real-time. They can manually select which MFA challenge to present to the user, facilitating the hijacking of business accounts and access to payment methods.
Entities
Claims
What the coverage asserts, and how many sources carry each claim.
- [● 2 SOURCES] Security researchers at Island identified a phishing campaign using AI service names.
- [● 2 SOURCES] The phishing campaign impersonates AI services including ChatGPT, Google Gemini, Claude, Manus, Perplexity, and Muse.
- [● 2 SOURCES] Attackers are using a 'browser-in-the-browser' (BitB) technique to display fake address bars.
- [● 2 SOURCES] The campaign aims to steal Google account passwords and multi-factor authentication (MFA) codes.
- [○ 1 SOURCE] An older version of the phishing platform was discovered in a misconfigured, public GitHub repository.
Timeline
-
[TECHNOLOGY] 12 sourcesAI services impersonated in sophisticated phishing campaign
Cybercriminals are using fake AI service portals and ‘browser-in-the-browser’ techniques to steal credentials and MFA codes from users of ChatGPT, Gemini, Claude, and other AI platforms.
-
[TECHNOLOGY] 2 sourcesCyberattack uses fake ChatGPT ads to deploy remote access malware
Hackers are using fake ChatGPT Google ads to trick users into installing a NetSupport RAT Trojan, granting attackers full remote access to computers, cameras, and sensitive data.
-
[TECHNOLOGY] 2 sourcesChatGPT phishing campaign targets user credentials
Cybercriminals are using fake ChatGPT billing emails to impersonate OpenAI, aiming to steal login credentials and payment information through convincing phishing pages.
Sources
canaltech.com.br · cybernoz.com · danstapub.com · dicaappdodia.com · financiarul.ro · gadget.ro · gizmologi.id · go4it.ro · insider.foxnews.com · monitorulneamt.ro · santafederf.com.ar · sempreupdate.com.br · telecom.co.nz · thehackernews.com · video.foxnews.com
This summary has been updated 2 times: see revision history