Phishing Sites and Apps Use ChatGPT as Lure

Security researchers have warned of several new Windows and Android phishing campaigns using ChatGPT to trick people into unwittingly downloading malware and handing in excess of their credit card information.

Cybersecurity firm Cyble mentioned that several of the phishing web-sites are getting distribute by a faux social media web site spoofed in the name of ChatGPT developer OpenAI.

“The web site looks to be attempting to develop believability by like a blend of written content, this sort of as videos and other unrelated posts,” it mentioned.

✔ Approved From Our Partners

Protect and backup your data using AOMEI Backupper. AOMEI Backupper takes secure and encrypted backups from your Windows, hard drives or partitions. With AOMEI Backupper you will never be worried about loosing your data anymore.

Get AOMEI Backupper with 72% discount from an authorized distrinutor of AOMEI: SerialCart® (Limited Offer).

➤ Activate Your Coupon Code

“However, a closer glance disclosed that some posts on the web page incorporate hyperlinks that guide end users to phishing webpages that impersonate ChatGPT. These phishing pages trick people into downloading malicious information on to their devices.”

These one-way links are typosquatted to make the victim feel they are becoming taken to an official ChatGPT web site exactly where they can obtain the significantly-talked about instrument. In simple fact, they choose the consumer to a site spoofed to surface like the real OpenAI web site, which functions a “Download for Windows” button.

Clicking on this will put in stealer malware on the victim’s machine, Cyble explained.

Yet another phishing site features a “Try ChatGPT” button which really installs the Lumma stealer, while other variants are remaining utilised to spread the Aurora stealer variant, the Clipper Trojan and some others.

A various phishing marketing campaign once more employs fake ChatGPT-relevant payment web pages that are intended to steal victims’ cash and credit rating card info, Cyble warned.

The security vendor also spotted 50 fake Android apps spoofing the ChatGPT manufacturer in get to sneak likely unwelcome packages, adware and adware on to victims’ units, as effectively as commit billing fraud.

“By posing as ChatGPT, these threat actors seek to deceive customers into thinking that they are interacting with a legit and reliable resource when in fact, they are being exposed to damaging and destructive content,” Cyble concluded.

“Users who slide victim to these malicious campaigns could put up with monetary losses or even compromise their individual facts, resulting in substantial hurt.”

ChatGPT basically poses a double phishing danger: as perfectly as fraudsters making use of it as a lure, security authorities have beforehand warned that budding cyber-criminals could use the AI technology to create convincing phishing strategies en masse.