Published on June 4, 2026
Malicious ChatGPT Download Website Tricks Users via Sponsored Search Listings
Severity
Medium
Threat actors are leveraging malvertising techniques through sponsored search listings to distribute a fake ChatGPT download site, demonstrating an increasing abuse of trusted AI brand names to deliver malware.
The campaign uses a lookalike domain (openew[.]app) that mimics official branding and offers downloads for Windows, macOS, and Chrome extensions, increasing its perceived legitimacy and targeting a wide range of users.
To evade detection, the attackers employ CAPTCHA gating, heavily obfuscated JavaScript, and staged payload delivery. These techniques ensure that malicious activity is only triggered after user interaction, reducing the effectiveness of automated analysis tools.
Infrastructure analysis indicates that the domain resolves to IP address 144[.]172[.]104[.]205, which has been associated with short-lived malicious infrastructure. Passive DNS records also suggest shared hosting with other suspicious domains.
The delivery mechanism is platform-aware. Windows users are served a malicious executable disguised as a ChatGPT installer, macOS users receive a separate payload designed to evade detection, and Chrome extension links redirect to legitimate extensions to reduce suspicion.
On Windows systems, the observed sample is an Inno Setup installer that deploys an Electron-based application. Although labeled as a Chat_GPT executable, analysis reveals inconsistent metadata and non-aligned product information.
The binary is signed using a certificate attributed to F.F.A.P. Hurkmans Beheer B.V., which is not associated with ChatGPT, indicating misuse of code signing to increase perceived trust.
Within the Electron package, researchers identified a heavily obfuscated JavaScript file (winter.js) responsible for core malicious logic. The script uses encoding, dynamic function resolution, and control-flow obfuscation to hinder analysis and conceal execution flow.
During execution, user interaction such as CAPTCHA completion triggers secondary behavior, including PowerShell execution with parameters such as “-ExecutionPolicy Unrestricted”, suggesting runtime delivery of additional payloads.
The malware also creates a persistent Chromium-style profile directory under %APPDATA%\Satoshi, likely used to store browsing data, cookies, and local application artifacts to mimic legitimate Electron application behavior.
Further analysis of winter.js indicates use of Node.js modules such as system information, file system handling, and process execution capabilities. These modules enable system reconnaissance, file manipulation, outbound communication, and execution of additional commands, effectively turning the malware into a flexible execution framework.
Successful execution of the malicious installer may result in system compromise, unauthorized remote access, credential theft, data exfiltration, and persistence on affected systems. The use of obfuscation, staged payloads, and legitimate-looking installers increases the likelihood of user deception and successful infection.
IOCs
| IOC Type | Value | Notes |
| Domain | openew[.]app | Fake ChatGPT download site used in the campaign . |
| IP Address | 144[.]172[.]104[.]205 | Hosting IP linked to the malicious infrastructure . |
| Windows SHA-256 | 56CC26E88C064B0C423AA8AD6530E58F91D1E4D28FAB1A8BCEDEF16A6582B4D2 | Malicious Windows installer sample . |
| App.exe SHA-256 | D9AD44D43E57B870793FA5CF7FB3A813990D0CBD0C7087BDE70A5E61FB1F1FE6 | Unsigned Electron payload extracted from the installer . |
| macOS SHA-256 | 7E5B708F6659B1FAD3AAE7B589A706434FBF21708AEEC5AF5910189B96E25FEF | Mac sample observed during analysis . |
| Suspicious File Path | %APPDATA%\Satoshi | Chromium-style profile directory created by the malware . |
| Suspicious Process | powershell.exe | Spawned with -ExecutionPolicy Unrestricted after CAPTCHA completion . |
Security teams should integrate these indicators into network and endpoint monitoring processes, with particular attention to newly downloaded executables impersonating trusted brands. These Electron-based applications may exhibit scripted execution behavior, inconsistencies between signer and product metadata, and connections to newly registered lookalike domains.
Recommendations
Users are advised to take the following precautions to reduce exposure to this threat:
- Avoid downloading software from sponsored search results, especially when impersonating high-profile platforms such as ChatGPT.
- Download software only from official and verified sources, and remain cautious of lookalike domains even when they closely resemble legitimate services.
- Be alert to suspicious indicators such as CAPTCHA-heavy download flows, unexpected installer behavior, and prompts to execute files immediately after browser interaction.
- Ensure endpoint protection is enabled and updated, and report any suspicious installation activity or unusual system behavior promptly.
Source
https://gbhackers.com/malicious-chatgpt-download-website-tricks-users/