The massive popularity of OpenAI’s chatbot ChatGPT has not gone unnoticed by cyber criminals: they are exploiting the public’s eagerness to experiment with it to trick users into downloading Windows and Android malware and visit phishing pages.
Fake ChatGPT apps for Windows and Android
Cyble’s researchers have spotted:
- A Facebook page misusing the ChatGPT name and logo to direct the audience to pages mimicking the ChatGPT website and offering a (non-existent) ChatGPT app for Windows for download (which is actually information-stealing malware)
- Some of these pages ask people to pay to use the ChatGPT service and present payment forms through which the criminals steal users’ personal and payment card information
- Android malware impersonating a (non-existent) ChatGPT Android app or other AI-related apps, which subscribes victims to premium services, steals data, display ads, etc. These have been found both on Google Play and third-party Android app stores – and apparently it has been going on for a while
The fake OpenAI pages serving malware have been set up on a variety of domains, and we can expect others still to pop up.
⚠️ Beware of these #ChatGPT domains that distributes malware
chat-gpt[.]run@OpenAI #cybersecurity #infosec pic.twitter.com/hOZIVGN4Wi
— Alvosec ⚛️Ⓜ️ (@alvosec) February 23, 2023
Advice for ChatGPT users
Users wanting to try out ChatGPT are advised to go directly to the source, i.e., to look for relevant information on OpenAI’s official page. At the moment, the chatbot service is only web-based.
Since Google Search has lately been serving malicious ads to users searching for popular software and games, searching for ChatGPT apps via Google Search might also prove dangerous at some point.
Those who have already fallen for one of these schemes should check their devices for malware and their accounts for unwanted subscriptions, and investigate what else has been comprimised in the meantime: online accounts, payment cards, banking information, etc.