Cybersecurity experts are warning users of a new wave of malware campaigns that are exploiting the popularity of AI chatbots like OpenAI's ChatGPT and xAI's Grok. Criminals are using deceptive online ads and search results to trick users into downloading information-stealing software onto their devices.
How the Attack Operates
The scheme relies heavily on search engine manipulation. Attackers purchase sponsored ads on platforms like Google, which appear at the top of search results for queries related to these AI tools. For example, searching for "chatgpt atlas" may display a malicious ad leading to a fake site titled "ChatGPT(tm) Atlas for macOS - Download ChatGPT Atlas for Mac."
Similarly, Grok's name is being misused in poisoned search results for common tech support queries, such as "how to clear disk space on macOS." Clicking these links directs users to fraudulent guides that, if followed, result in malware installation instead of providing legitimate help.
Identifying the Threat
A major red flag is the nature of the pages users are directed to. Genuine ChatGPT shared conversation links use a specific format: chatgpt.com/share/. Be wary of any installation guide, especially one claiming to be for a non-existent "Atlas browser," that appears on a page showing a message like, "This is a copy of a conversation between ChatGPT & anonymous."
Key Safety Recommendations
To protect yourself from these threats, cybersecurity analysts advise:
Be Skeptical of Sponsored Results: Exercise extreme caution with paid ads, especially for software downloads or tech troubleshooting.
Verify Official Sources: Only download software or follow guides from the official websites of the product (openai.com, x.ai). Do not trust third-party "installation guides" for these platforms.
Do Not Blindly Execute Commands: Never run command-line instructions (in Terminal or PowerShell) from an unverified source, even if it appears within a search engine or AI chat interface.
Trust Your Instincts: If instructions for a technical task seem convoluted or unusual, seek official documentation or consult a trusted expert.
Staying vigilant about the source of online information is crucial, as cybercriminals continue to leverage the trust users place in major tech brands and search engines to deploy their attacks.
