Attackers are exploiting the chat-sharing features in ChatGPT and Claude to spread malware through shared conversations. The chats mimic error messages or install guides and slip past security tools undetected because they're hosted on trusted domains.
Attackers are exploiting shared chat links in ChatGPT and Claude to push malware. Both platforms let users share conversations publicly via URL. Victims stumble onto these chats through paid search ads. Because the links sit on trusted domains, security tools don't flag them, and users are more likely to trust what they see.
Indicator
Type
hxxps://claude[.]ai/share/8e6401b5-4849-46c4-a3cb-29e1c3c49131
hxxps://chatgpt[.]com/s/cb_6a0f1e6bbec88191aa7fede27163f08d
Hackers are now using ChatGPT share links to deliver malware
ChatGPT share links abused to host fake outage pages to deliver malware
ChatGPhish Vulnerability Turns ChatGPT Web Summaries Into a Phishing Surface
Fake ChatGPT download site infects Windows and Mac users with malware
ChatGPT blindly trusts browser content, turning the page into a payload
Fake software on GitHub and SourceForge distribute Deno RAT
AI Chatbot Recommendations Redirect Users to Cryptojacking Malware Sites
Russia-linked threat group put ChatGPT to work from lure to payload
GPU mining malware spreads via SEO poisoning, AI chatbots
What Is an AI Prompt Injection Attack? The Hidden Threat Hijacking Your Chatbots - Decrypt
Hackers are now abusing ChatGPT to generate malicious webpages that trick unsuspecting users into downloading malware onto their…
Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download…
Attackers are abusing Google Ads and legitimate Claude.ai shared chats in an active malvertising campaign. Users searching for…
ChatGPhish exploits ChatGPT Markdown rendering to deliver phishing content from summarized web pages, increasing AI attack…
Searching for ChatGPT? This fake download site serves malware to both Windows and Mac users, using separate payloads tailored to…
We break down a new infostealer attack that combines the ClickFix technique with a shared chat containing malicious user guides…
