Malicious ChatGPT Download Website Tricks Users via Sponsored Search Listings

Threat actors are abusing paid search ads to push a fake ChatGPT download site, underscoring how malvertising is increasingly used to target users who trust well-known AI platforms.

The campaign relies on a lookalike site and sponsored listings to trick users into downloading malware under the guise of a legitimate ChatGPT installer.

Malicious ChatGPT Download Website

Security researchers from Evalian SOC observed that the operation uses the domain openew[.]app, which closely mimics OpenAI branding and offers downloads for Windows, macOS, and a Chrome extension. This multi-platform presentation gives the site a sense of legitimacy and broadens its potential victim pool.

To further evade automated checks, the attackers implement CAPTCHA verification, heavily obfuscated JavaScript, and staged payload delivery, ensuring that most malicious activity occurs only after real user interaction.

Infrastructure analysis shows that openew[.]app resolves to IP address 144[.]172[.]104[.]205, hosted on infrastructure commonly abused for short-lived malicious campaigns.

Passive DNS records tie this IP to multiple suspicious domains, suggesting shared infrastructure across several operations.

The delivery mechanism is platform-aware: Windows users are served a malicious executable masquerading as a ChatGPT installer, macOS users receive a separate payload that initially evades detection, and the Chrome extension link redirects to a legitimate add-on to further lower suspicion. This blending of real and malicious components increases user trust while quietly enabling infection.

On Windows, the primary sample (SHA256: 56CC26E88C064B0C423AA8AD6530E58F91D1E4D28FAB1A8BCEDEF16A6582B4D2) is an Inno Setup installer that deploys an Electron-based application. Although it is named Chat_GPT.exe, static analysis reveals inconsistent metadata and a product description unrelated to OpenAI.

The executable is signed by F.F.A.P. Hurkmans Beheer B.V., a publisher with no obvious link to ChatGPT, which is a strong signal that code signing is being misused to add a veneer of trust.

Embedded Chromium and Electron components indicate the installer is primarily a wrapper for a packaged runtime environment, with the main payload (App.exe, SHA256: D9AD44D43E57B870793FA5CF7FB3A813990D0CBD0C7087BDE70A5E61FB1F1FE6) acting as a loader that depends heavily on runtime behavior, making static detection more difficult.

Within the extracted Electron archive, analysts identified a heavily obfuscated JavaScript file, winter.js, as the core logic. This script uses hex-encoded strings, dynamic function resolution, and control-flow obfuscation to frustrate reverse engineering and hide its true intent.

Execution is event-driven and tightly coupled with user interaction, with key behaviors exposed only after the CAPTCHA is completed.

During dynamic analysis, completing the CAPTCHA resulted in the creation of multiple PowerShell processes launched with “-ExecutionPolicy Unrestricted -Command -”, indicating that second-stage commands or payloads are likely executed at runtime rather than appearing in the command line.

In parallel, the malware creates a persistent Chromium-style profile directory at %APPDATA%\Satoshi, which stores cookies, local storage, cache, and preferences, further disguising itself as a legitimate Electron-based application rather than a fake ChatGPT client.

Partial deobfuscation of winter.js reveals the use of core and third-party Node.js modules, significantly expanding the threat surface. Modules such as system information and os enable system reconnaissance. At the same time, fs and zip-lib provide file system and archive handling capabilities.

The child_process module supports process execution, and the http/https modules facilitate outbound network communication. Together, these capabilities show that the malware acts as a flexible execution framework capable of gathering host information, interacting with the filesystem, executing additional tools, and communicating over the network, rather than being a simple one-shot dropper.

Ioc

IOC Type	Value	Notes
Domain	openew[.]app	Fake ChatGPT download site used in the campaign .
IP Address	144[.]172[.]104[.]205	Hosting IP linked to the malicious infrastructure .
Windows SHA-256	56CC26E88C064B0C423AA8AD6530E58F91D1E4D28FAB1A8BCEDEF16A6582B4D2	Malicious Windows installer sample .
App.exe SHA-256	D9AD44D43E57B870793FA5CF7FB3A813990D0CBD0C7087BDE70A5E61FB1F1FE6	Unsigned Electron payload extracted from the installer .
macOS SHA-256	7E5B708F6659B1FAD3AAE7B589A706434FBF21708AEEC5AF5910189B96E25FEF	Mac sample observed during analysis .
Suspicious File Path	%APPDATA%\Satoshi	Chromium-style profile directory created by the malware .
Suspicious Process	powershell.exe	Spawned with -ExecutionPolicy Unrestricted after CAPTCHA completion .

Note: IP addresses and domains are intentionally defanged (e.g., [.]) to prevent accidental resolution or hyperlinking. Re-fang only within controlled threat intelligence platforms such as MISP, VirusTotal, or your SIEM.

Security teams should incorporate these indicators into network and endpoint monitoring, while also monitoring for newly downloaded executables that mimic trusted brands. These Electron applications invoke scripting engines, mismatched signer and product metadata, and access to newly registered lookalike domains.

From a defensive perspective, this campaign highlights how malvertising is an effective initial access vector, leveraging legitimate ad platforms and user intent rather than traditional phishing lures.

The layered use of CAPTCHA gating, obfuscated JavaScript, and staged, event-driven execution is designed to evade sandboxes and signature-based detection, shifting the emphasis to behavioral and telemetry-driven controls.

Organizations should prioritize endpoint visibility, robust logging, and anomaly detection that can spot unusual process chains and unexpected application directories, especially after software downloads from search results.

Follow us on Google News, LinkedIn, and X to Get Instant Updates and Set GBH as a Preferred Source in Google.