The rise of Scammers Are Now Hosting Malware is reshaping how we think about technology and security. I’ve spent twenty years telling people to check the URL before they click anything. If it says google.com or microsoft.com, you’re probably fine. If it’s russian-bank-login-totally-real.xyz, you run.
That rule just died.
Security researchers at Push Security have uncovered a campaign they’re calling LLMShare, and it’s one of the craftiest things I’ve seen this year. Attackers are using ChatGPT’s own content sharing feature to host malicious pages. The URL starts with chatgpt.com. The padlock icon is there. The domain is legitimate. Everything looks right.
It’s completely fake.
How the Attack Works
Here’s the playbook. It’s simple, which is exactly why it works.
Someone searches Google for “ChatGPT.” They see a sponsored ad at the top of the results (attackers are running Google Ads campaigns targeting these keywords). They click it. Instead of landing on a normal ChatGPT page, they’re taken to a shared ChatGPT conversation, sitting on the real chatgpt.com domain.
The page shows what looks like a legitimate outage notice. “We’re experiencing high traffic right now,” it says. “Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.”
Sounds plausible. ChatGPT does go down. They do have a desktop app. What’s the harm?
The “download” button takes victims to a site called openew.app, which is dressed up to look exactly like OpenAI’s official download portal. From there you get a choice: Windows or Mac. Both versions contain malware. The Windows version checks if it’s running in a virtual machine or sandbox first (researchers call this cloaking), meaning antivirus scanners often see nothing wrong. If it’s a real computer, the payload executes.
Why This Matters More Than a Standard Phish
We’ve all seen fake login pages before. What makes LLMShare different is the domain. It’s not chatgpt-support.com or openai-download.net. It’s chatgpt.com. The real one. Verified certificate. Green padlock. The whole trust infrastructure that we’ve spent two decades building into browsers is now working against us.
The attackers exploited ChatGPT’s HTML rendering capability. They wrote a prompt that generates a custom HTML and CSS page, published it as a shared conversation, and got a legitimate chatgpt.com/s/ URL out of it. Push Security noted that if you look closely, you can actually see the “Show code” and “Remix with ChatGPT” buttons on the page. It’s literally just ChatGPT rendering a malicious webpage.
This isn’t a vulnerability in the traditional sense. OpenAI’s systems are working as designed. The attackers are simply using the feature more creatively than the designers imagined.
It’s Not Just ChatGPT
This is part of a broader trend. Earlier this year, attackers ran Google Ads directing Claude users to shared Claude conversations containing malicious installation instructions. Other campaigns abused shared ChatGPT and Grok conversations to run ClickFix attacks, tricking victims into pasting commands into their terminals that installed malware.
Claude’s Artifacts feature has been used the same way. Every AI platform with a content sharing feature is now a potential malware distribution vector. The platforms built these features for collaboration and sharing. Criminals saw a trusted domain with user-generated content and built a scam delivery network on top of it.
This is what happens when platforms move faster than their threat models. AI companies are shipping features at breakneck speed. The security implications of those features often get considered after the fact.
What You Should Actually Do
First, the obvious stuff. Only download ChatGPT from openai.com. If you’re ever on a page that looks like ChatGPT but is asking you to download something, check the actual URL carefully. If it says chatgpt.com/s/ followed by a random string, you’re looking at someone’s shared conversation, not an official page.
Second, and this is important for IT teams: update your security awareness training. The old “check the domain” advice is no longer sufficient when attackers can host content on the same domain as the legitimate service. Your staff need to understand that chatgpt.com can serve malicious content, just like drive.google.com or dropbox.com can.
Third, endpoint protection that detects VM and sandbox evasion is not optional anymore. The LLMShare malware specifically checks whether it’s being analyzed before executing. If your security tools can’t flag that behaviour, you’re flying blind.
Fourth, organisations should seriously consider blocking or monitoring shared AI conversation links in corporate environments. I know that sounds heavy-handed, but when the attack surface includes legitimate domains that your proxy and firewall inherently trust, you need compensating controls.
Trusting a domain is not the same as trusting everything on it. The browser doesn’t know the difference between OpenAI’s outage page and a criminal’s ChatGPT conversation. You have to.