# Threat Actors Weaponize ChatGPT Share Links to Deliver Malware via Fake Outage Pages


Cybercriminals are exploiting OpenAI's legitimate content-sharing features to conduct targeted malware campaigns with sophisticated social engineering tactics. The "LLMShare" campaign, recently uncovered by Push Security, demonstrates how AI platform vulnerabilities can be weaponized at scale when combined with advertising infrastructure and cloaking techniques.


## The Threat


The LLMShare campaign represents a novel approach to delivering malware by leveraging trusted infrastructure. Threat actors are using Google paid search advertisements to redirect users searching for ChatGPT toward malicious shared ChatGPT pages hosted directly on OpenAI's domain (chatgpt.com/s/). When victims click these ads, they arrive at what appears to be a legitimate ChatGPT URL displaying an official-looking outage notice.


The fake outage message reads: *"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue."*


This social engineering approach exploits two human vulnerabilities simultaneously: trust in familiar domains and urgency during service disruptions. Users seeing an outage message from chatgpt.com are far more likely to comply with download instructions than if the same message appeared on an unfamiliar domain.


When users click the download button, they are redirected to openew[.]app, a spoofed OpenAI download portal that distributes malware for both Windows and macOS systems. The malware payloads remain unconfirmed, though previous similar campaigns have distributed infostealers and other credential-theft malware.


## Background and Context


This campaign exemplifies a broader trend of threat actors exploiting AI platform sharing features. Push Security's research reveals that malicious actors have systematically abused content-sharing capabilities across multiple AI services:


  • ChatGPT share links have been weaponized to host fake outage pages and ClickFix scams
  • Claude Artifacts (Anthropic's code/application sharing feature) have been abused to distribute ClickFix-style lures
  • Shared conversations on both ChatGPT and Grok have hosted malicious installation instructions disguised as legitimate guides

    • Earlier in 2026, a separate campaign used Google advertisements to direct users searching for Claude downloads to fraudulent shared conversations containing malware installation steps. The consistent pattern suggests threat actors view AI platform sharing features as high-trust distribution channels that bypass traditional email and web filtering controls.


    The key advantage of these platforms: content is rendered from legitimate domains with legitimate security certificates, making traditional URL reputation filters largely ineffective.


    ## Technical Details


    ### The Rendering Attack


    The LLMShare campaign's technical sophistication lies in how it exploits ChatGPT's HTML rendering capabilities. Rather than hosting a phishing page on attacker-controlled infrastructure, the threat actors created a custom HTML page and published it through ChatGPT's share feature (chatgpt.com/s/links).


    When visitors access these links, they see a rendered HTML page—complete with CSS styling and interactive elements—served directly from OpenAI's domain. The page includes visible ChatGPT interface elements like "Show code" and "Remix with ChatGPT" buttons, providing plausible deniability that the content is user-generated rather than a phishing attack.


    ### Cloaking Evasion


    The download site at openew[.]app employs cloaking technology to evade automated security scanning. When security platforms like URLScan attempt to analyze the URL, they receive a benign AR/VR company website instead of the malware portal. This selective content delivery ensures that:


  • Automated threat intelligence systems see harmless content
  • Only users matching specific targeting criteria (geographic location, IP reputation, user-agent patterns) see the malicious download
  • Security researchers and sandboxes may incorrectly classify the domain as benign

    • The Windows malware variant, analyzed on Any.Run, executes reconnaissance commands to determine whether the infected device is:

  • A legitimate user computer
  • A virtual machine or sandbox environment
  • A security researcher's system

    • This detection evasion ensures the malware only executes fully on real victim systems, further reducing detection rates.


    ### Attack Chain Summary


    | Stage | Mechanism | Trust Signal |

    |-------|-----------|--------------|

    | Discovery | Google paid search ads | Legitimate ad network |

    | Landing | ChatGPT share link (chatgpt.com/s/) | OpenAI domain, HTTPS |

    | Social Engineering | Fake outage notice with urgency | Rendered from legitimate platform |

    | Payload Delivery | Spoofed download site (openew[.]app) | Domain typosquatting, cloaking |

    | Execution | Platform-specific malware installers | VM detection, evasion |


    ## Implications for Organizations and Users


    ### Immediate Risk Factors


    Individual Users:

  • Searching for ChatGPT downloads during perceived outages creates peak vulnerability
  • Legitimate-looking outage messages significantly increase compliance rates with malicious instructions
  • Domain-level trust ("it says chatgpt.com") overrides skepticism about unusual behavior

    • Organizations:

  • Employees conducting work during platform outages may be targeted at elevated rates
  • Cloud service outages create social engineering opportunities for threat actors
  • Traditional URL filtering may fail when content is hosted on legitimate platforms

    • ### Broader Implications


    This campaign highlights a critical gap in AI platform security: content-sharing features lack sufficient abuse prevention mechanisms. While these features provide legitimate utility for users and developers, they simultaneously create distribution channels for malware that:


    1. Bypass email-based phishing filters

    2. Evade domain reputation systems

    3. Leverage trust in legitimate service providers

    4. Can be rapidly deployed and modified without traditional hosting infrastructure


    The abuse of AI artifacts and shared conversations is likely to expand as threat actors recognize the advantages of platform-based distribution over traditional phishing infrastructure.


    ## Recommendations


    ### For Platform Providers (OpenAI, Anthropic, Others)


  • Implement rate limiting and throttling on share link generation to prevent bulk creation of malicious content
  • Require human review for content shared with links before public access (with expedited review for legitimate users)
  • Add visible warnings when shared content mimics official service status pages
  • Implement domain-specific rendering restrictions to prevent impersonation of official company domains and outage pages
  • Monitor for suspicious patterns: identical content published across many links, rapid creation/deletion cycles, geographic targeting anomalies

    • ### For Organizations and SOC Teams


  • Block or closely monitor traffic to lookalike domains using typosquatting patterns (e.g., openew[.]app mimicking openai[.]app)
  • Alert on unexpected outage announcements during normal service operations; verify through official status pages before taking action
  • Implement code execution restrictions on user systems to prevent malware from executing reconnaissance commands
  • Train users to verify platform status through official channels (status.openai.com) rather than following download links from unexpected notifications
  • Monitor for infostealer exfiltration from newly discovered malware families; LLMShare predecessors distributed credential-theft malware

    • ### For Individual Users


  • Verify platform status independently by visiting the official status page (status.openai.com) before downloading applications
  • Be skeptical of download prompts during outages; legitimate platforms typically provide web-based workarounds
  • Check download domain carefully; OpenAI's official download is openai.com, not lookalike domains
  • Avoid downloading software from ads when possible; use official product pages and app stores instead

    • ---


    ## HackWire Analysis


    The LLMShare campaign succeeds because it exploits a fundamental trust asymmetry: users trust domains more than they scrutinize content. When that trusted domain (chatgpt.com) serves a message claiming service unavailability, skepticism evaporates. This pattern will likely define attack campaigns throughout 2026.


    What's particularly notable here is the normalization of AI platform abuse. We've gone from isolated campaigns abusing individual shared conversations to systematic weaponization of entire features. Push Security's discovery of similar tactics across ChatGPT, Claude Artifacts, and Grok suggests threat actors now view AI sharing capabilities as standard malware distribution infrastructure—as reliable and routine as compromised WordPress blogs or malicious ads.


    The cloaking layer adds another dimension: these attacks are designed to *fail gracefully* in sandboxes and security environments. When a malware operator sees that automated tools visiting openew[.]app get harmless content, they've gained valuable intelligence. The malware only activates for real users, meaning detection rates stay low and campaigns can run longer.


    Organizations should update their incident response playbooks: outage announcements are now a social engineering vector. When ChatGPT, Claude, or any critical cloud service goes down, staff will naturally search for workarounds. Threat actors will be waiting in that search traffic. The defense isn't perfect verification protocols (too cumbersome during actual outages)—it's teaching teams to use *official status pages* as their sole source of truth, bookmarked and referenced before any download occurs.


    For defenders, the deeper lesson is this: you can't filter or block your way out of trusted-domain attacks. A ChatGPT share link is a legitimate ChatGPT share link. The malice is in the content, not the infrastructure. That means the responsibility for abuse prevention shifts entirely to platform vendors. OpenAI and Anthropic need to make sharing features significantly harder to weaponize—rate limiting, review mechanisms, and behavioral heuristics to flag suspicious content patterns—or expect these features to become standard malware vectors.


    — HackWire Editorial


    ---


    ## Related Coverage


  • Read more in our [Malware](https://www.hackwire.news/category/malware) coverage
  • Cross-reference with [Phishing](https://www.hackwire.news/category/phishing) and [Social Engineering](https://www.hackwire.news/category/social-engineering)
  • Stay current via the [HackWire homepage](https://www.hackwire.news/)