A new wave of malicious advertising is exploiting the popularity of ChatGPT by promoting a counterfeit download site through sponsored search results, effectively distributing malware to both Windows and macOS platforms.
Deceptive Branding and Sponsored Ads
Security experts from Evalian’s SOC team have uncovered this operation, which utilizes authentic-looking OpenAI branding and search engine advertisements to attract users in search of legitimate AI tools. The core of the campaign is a malicious website, openew[.]app, which closely resembles an official ChatGPT download page.
On this site, users are offered various download options, including Windows, macOS, and a Chrome extension. While the browser extension redirects users to a legitimate listing, the Windows and macOS installers deploy trojanized payloads, compromising the user’s system.
Technical Analysis of the Malware
The domain, freshly registered via Namecheap, resolves to an IP address hosted on RouterHosting infrastructure, known for hosting short-lived malicious campaigns. The Windows payload, labeled as Chat_GPT.exe, utilizes an Inno Setup installer to deploy an Electron-based application. Despite its legitimate appearance, discrepancies in the binary’s metadata and code-signing certificate raise suspicions.
Further analysis reveals the application includes a Chromium-based runtime and an obfuscated JavaScript payload, complicating straightforward analysis. The program features Node.js modules that enable system reconnaissance, file manipulation, and command execution, indicating its malicious capabilities.
Evasion Techniques and Threat Landscape
The malware employs CAPTCHA-based gating to evade automated sandbox detection. Once the CAPTCHA is completed, multiple PowerShell processes are initiated, suggesting staged payload delivery through runtime command injection.
Evalian’s team notes the malware’s persistence through a Chromium-style profile in the %AppData%Satoshi directory, storing data such as cookies and cache files. The use of legitimate DNS-over-HTTPS services further obscures the malware’s command-and-control communications, blending them with normal network traffic.
The macOS variant remains largely undetected by antivirus software, indicating either a low distribution volume or effective evasion methods. This campaign exemplifies how threat actors leverage trusted branding and advanced application frameworks to refine their malvertising strategies.
Implications and Defensive Measures
This campaign underscores the evolving threat landscape as AI tools gain traction, highlighting the growing risk of brand impersonation in malware distribution. To combat such threats, defenders should monitor unexpected Electron applications, mismatched installer metadata, and unusual directories.
Proactive measures include analyzing process behavior and keeping an eye on newly registered domains masquerading as software vendors. As these threats persist, enhancing user awareness and implementing robust behavioral detection controls are crucial in safeguarding against these sophisticated attacks.
