Back Philiphall

Scammers Are Now Hosting Malware on chatgpt.com. Yes, the Real One.

Philiphall •Phil Hall • May 29, 2026

Attackers are using ChatGPT's own content sharing feature to host malicious pages on chatgpt.com, tricking users into downloading malware through Google Ads. The LLMShare campaign exploits the very domain trust we've spent decades building.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malware Delivered via ChatGPT Links in New Cyber Attack Campaign Threat actors are exploiting ChatGPT's content-sharing feature to deliver malware through a campaign dubbed 'LLMShare.' This attack involves creating fake outage pages on the legitimate chatgpt.com domain, tricking users into downloading malicious software disguised as the ChatGPT desktop application. Google ads are used to lure victims searching for ChatGPT, leading them to these fraudulent pages. Once on the site, users see a fake message about high traffic and are prompted to download the malware. The malicious downloads target both Windows and macOS systems, with the Windows version executing commands to check for security software. The attackers utilize cloaking techniques to hide the true nature of the site from automated security tools. The campaign highlights a significant risk associated with the misuse of AI platform features for malicious purposes. 22 sources 65

Extracted Entities

Scammers Are Now Hosting Malware on chatgpt.com. Yes, the Real One.

The full story

Extracted Entities

Attack Types (1)

Campaigns (1)

Domains (1)

Platforms (2)