Hackers Leverage Legitimate ChatGPT Links to Distribute Malware
Attackers are using shared ChatGPT conversation links to trick Windows users into executing malicious commands that install malware, including a remote control client.
A new malware campaign is exploiting the trust users place in legitimate services by embedding malicious instructions within shared ChatGPT conversations. Threat actors are not compromising OpenAI's infrastructure but are instead manipulating user-generated shared content to lure victims into executing commands that lead to malware installation. This tactic, identified by JOERverser analysts as a "malicious ClickFix operation," highlights the danger of blindly trusting even well-known domains.
The attack begins with a seemingly innocuous shared ChatGPT link. When a user clicks this link, they are presented with a deceptive message claiming high traffic and directing them to a fake backup website. This landing page employs social engineering, presenting a fake human verification screen that instructs the user to open the Windows Run dialog (Win+R), paste a command, and press Enter. This manual execution step is crucial, as it bypasses typical browser-based security warnings.
Once the user executes the command, a PowerShell-based download chain is initiated outside the browser. This chain is designed to be stealthy, with the script window hidden from the user. The initial stage collects sensitive system and network information, including the victim's public IP address, location, internet provider, time zone, Windows version, and administrator status. This data is then exfiltrated to a Telegram chat.
The campaign's payload is concealed within what appears to be a valid MP4 video file. This file is downloaded from a command-and-control server and contains an encrypted and compressed PowerShell bundle. Researchers were able to extract approximately 20 embedded files from this bundle, notably including a signed NetSupport remote-control client and its supporting components.
The use of NetSupport, a legitimate remote administration tool, is particularly concerning. While it has valid uses in IT support, its deployment through this malicious chain transforms it into a tool for unauthorized access, monitoring, and potential follow-on attacks. The loader also attempts to cover its tracks by clearing the Windows Run history.
This campaign underscores a broader trend where attackers leverage "ClickFix" techniques, which rely on user interaction and trust in familiar interfaces rather than exploiting software vulnerabilities. The tactic of embedding malicious commands within seemingly legitimate shared content, combined with the use of dual-use software like NetSupport, presents a significant risk to end-users.
Security experts advise users to be extremely cautious of any website that prompts them to open system utilities like Run, Terminal, Command Prompt, or PowerShell to verify their identity. Instead of following such instructions, users should close the page, inspect any content before executing it, and report suspicious activity to their security teams. Organizations can mitigate this threat by blocking the identified malicious infrastructure and investigating the associated file hashes.