ChatGPT share links abused to host fake outage pages to deliver malware

Threat actors have hijacked ChatGPT’s LLMShare feature to host counterfeit outage pages that redirect users to a malicious download portal.

The campaign, dubbed “LLMShare,” uses Google ads to lure people searching for ChatGPT, landing them on a chatgpt.com/s/ link that displays a fabricated outage notice. The notice claims the web version is unavailable and urges users to download a desktop app, which leads to openew.app, an impersonated OpenAI download site that installs malware on macOS and Windows. The attackers generate the fake page with custom HTML and CSS rendered by a ChatGPT prompt, and the page includes “Show code” and “Remix with ChatGPT” controls. Similar abuse has been seen with Claude Artifacts, where shared conversations host ClickFix‑style lures. The malicious site uses cloaking to show different content to targeted victims, while appearing harmless to security scanners. The malware payload can execute commands to detect virtual machines and may deliver infostealers. The attack demonstrates how AI platform sharing features can be weaponised for phishing and malware distribution.