⚠️ ChatGPT Share Links Abused in LLMShare Phishing Campaign

Threat actors have found a clever new way to weaponise AI platforms: they abuse ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. The campaign, dubbed LLMShare, was discovered by security researchers at Push Security and represents an evolution in phishing techniques that bypasses traditional detection methods. What makes this attack particularly dangerous is that the malicious content lives on a legitimate OpenAI domain — not an attacker-controlled server that security tools can blacklist.

This is not a theoretical vulnerability. The LLMShare campaign is active, it is spreading, and it targets anyone searching for AI tools. In this article, I will break down exactly how the attack works, why AI platform sharing features are a growing phishing vector, and what you can do to protect yourself and your team. If you use ChatGPT, Claude, Grok, or any AI platform regularly, understanding this threat is essential.

The LLMShare Campaign: How It Works

Unlike conventional phishing attacks that rely on attacker-controlled infrastructure, LLMShare operates from a legitimate OpenAI domain. The attackers create a custom HTML page using ChatGPT's rendering capabilities and publish it through a shared chatgpt.com/s/ link. The fake outage notice is displayed from a URL that begins with chatgpt.com — a domain that email filters, URL scanners, and security platforms are trained to trust. When a security scanner evaluates the link, it sees a legitimate OpenAI certificate and a domain with an excellent reputation. The scanner passes it instantly.

Visitors who land on the page see a professional-looking outage message: "We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue." This message is rendered entirely within ChatGPT's own interface, complete with "Show code" and "Remix with ChatGPT" controls that reveal the underlying custom HTML and CSS. To an average user, the page looks indistinguishable from an official OpenAI communication — the domain in the address bar is chatgpt.com, the branding matches, and the message is professionally written.

The fake outage page includes a prominent download button labelled "Download ChatGPT Desktop." The button triggers an automatic redirect to openew[.]app, a domain registered by the attackers that mimics OpenAI's official download portal. This separation between the hosted content (on chatgpt.com) and the malicious download (on openew.app) is intentional — it keeps the phishing page clean while routing victims to the payload.

The Infection Chain: From Google Ad to Malware

The attack follows a multi-stage infection chain designed to evade detection at every step. Understanding this chain helps you recognise where the attack can be stopped.

Step 1: Malicious Google Advertising. Attackers purchase Google Ads that appear when users search for ChatGPT-related terms like "ChatGPT desktop app" or "ChatGPT download." These sponsored results appear at the top of Google Search, often above organic results, giving them visibility indistinguishable from legitimate ads. Google's ad review process does not catch these because the ad links to a legitimate chatgpt.com URL.

Step 2: Redirect to Legitimate ChatGPT URL. Clicking the ad takes the user to a real ChatGPT shared page at chatgpt.com/s/.... Because the traffic arrives at a genuine OpenAI domain, most security scanners and URL reputation systems pass it without a second look. The page is technically a real ChatGPT conversation — it just happens to contain custom HTML that renders a fake outage notice.

Step 3: Fake Outage Notice Rendered. Instead of a normal ChatGPT conversation interface, the page displays the fake outage message with OpenAI branding. The browser URL bar shows chatgpt.com — a domain most users implicitly trust. At this point, the user has no visible indication that anything is wrong.

Step 4: Drive to Malicious Download. The fake outage page includes a prominent "Download ChatGPT Desktop" button. Clicking it redirects the user to openew[.]app, a site specifically crafted to impersonate OpenAI's official desktop application download portal. The landing page copies OpenAI's design language, logos, and layout.

Step 5: Payload Delivery. The downloaded file from openew[.]app installs malware on the victim's device. Push Security reports that the campaign uses anti-analysis techniques to determine whether the device is a legitimate computer or a virtual machine used by security researchers. If the malware detects a sandboxed environment, it may refuse to execute — making it harder for automated analysis tools to identify the threat.

Step 6: Data Exfiltration. Once installed, the malware can steal saved credentials from browsers, session cookies, cryptocurrency wallets, and other sensitive data stored on the device. This data is exfiltrated to attacker-controlled servers and can be used for identity theft, account takeover, or sold on dark web markets.

Claude Artifacts: The Same Technique, Expanded

Push Security also observed attacks abusing Claude Artifacts, Anthropic's feature for sharing rendered applications and content. These attacks host ClickFix-style lures that trick users into executing malicious commands. The ClickFix technique presents users with a fake error message — "Your browser is out of date" or "A security update is required" — and provides a button to "fix" the issue that actually copies a malicious command to the clipboard. When the user pastes and runs the command in their terminal, the malware installs.

Previous related campaigns have abused shared ChatGPT and Grok conversations to deliver the AMOS infostealer on macOS. AMOS (Atomic macOS Stealer) targets browser cookies, passwords, and cryptocurrency wallets, and has become one of the most prevalent macOS malware families in 2025–2026. The cross-platform nature of these attacks — targeting Windows via LLMShare and macOS via AMOS — shows that AI platform phishing is platform-agnostic.

The common thread across all these campaigns is the abuse of trusted domain reputation. Whether it is chatgpt.com, claude.ai, or grok.com, attackers are exploiting the fact that these domains are categorised as "safe" by every security tool. Content hosted on these platforms is dynamic, user-generated, and largely immune to traditional URL blocklisting.

Why AI Platform Sharing Features Are a New Phishing Vector

AI content-sharing features present a unique challenge for security teams: content served from chatgpt.com, claude.ai, or grok.com benefits from the reputation of some of the most visited domains on the internet. Unlike static phishing pages that can be crawled and catalogued by URL scanning services, AI-shared content is generated dynamically and can be modified by the attacker at any time. A shared ChatGPT conversation that was benign when scanned at 9 AM could be malicious by 10 AM.

This chameleon-like quality makes AI-shared content particularly difficult to defend against. Security teams that maintain blocklists cannot keep pace with the volume of shared AI content being created every minute. Even AI platform providers themselves face a challenge — scanning every piece of user-generated rendered content for malicious intent at the scale of millions of daily users is a significant technical problem. OpenAI, Anthropic, and others have content policies, but enforcement at scale is inherently reactive.

The implications go beyond ChatGPT and Claude. Any platform that allows users to create and share rendered web content — whether through AI sharing features, collaborative documents, or embeddable widgets — is potentially vulnerable to the same technique. As AI platforms add more sharing and collaboration features, we can expect this attack vector to grow.

How Password Managers and MFA Protect Against AI-Platform Phishing

While the LLMShare campaign is primarily a malware delivery mechanism rather than a credential harvesting attack, the principles of defence remain similar. A password manager like NordPass provides a critical safety net: if malware does compromise your device, having unique, strong passwords for every account means the attacker cannot use a single stolen credential to access multiple services. NordPass's encrypted vault ensures that even if malware is present on your system, your stored passwords remain protected behind the master password.

Multi-factor authentication is your second line of defence. Even if malware steals a saved credential from your browser, MFA blocks the attacker from logging in because they lack the second factor — whether that is a TOTP code, a push notification, or a hardware security key. Enabling MFA on your email account is especially critical, since email is the recovery mechanism for most other accounts. If an attacker gains access to your email, they can reset passwords for your banking, social media, and work accounts.

For businesses, enforcing MFA across all team accounts and mandating the use of a password manager with shared vaults can significantly reduce the blast radius of a successful malware infection. Combined with the three-step protocol below, these tools create overlapping layers of defence that protect even against novel attack vectors like LLMShare.

Three-Step Protocol for Avoiding AI-Platform Phishing

Step 1: Navigate directly, never through ads. If you want to download the ChatGPT desktop app, navigate directly to openai.com by typing the address in your browser. Do not click Google Ads, sponsored search results, or promoted social media posts. The official ChatGPT desktop app is available through OpenAI's own download page, and legitimate software updates are delivered through the app itself, not through web pages. Make it a habit to type URLs manually for any software download.

Step 2: Verify the download domain. Even if a link takes you to chatgpt.com/s/xyz, that page can contain links to download sites on entirely different domains. Before downloading any file, check the domain in your browser's address bar. Legitimate software downloads from OpenAI happen on openai.com or cdn.openai.com, not on lookalike domains like openew.app, chatgptdownload.com, or openai-desktop.net. If the domain does not match the official website, do not download.

Step 3: Never execute commands from AI conversations. Legitimate software never requires you to run terminal commands from a web page. If an AI conversation, shared link, or document artifact asks you to copy and paste a command into your terminal, it is a phishing or malware attack. This is the ClickFix technique in action — it bypasses browser-based security controls because you are voluntarily running the command. No legitimate company will ever ask you to do this. Period.

These three steps cost nothing to implement and protect against the vast majority of AI-platform phishing attacks. A password manager like NordPass adds an additional layer by ensuring unique credentials and encrypted storage, so even if malware does manage to install, the damage is contained.

Key Takeaways

The LLMShare campaign demonstrates that AI platform sharing features have become a legitimate phishing vector. Attackers are exploiting the trust we place in domains like chatgpt.com and claude.ai to deliver malware, and traditional URL-based security tools cannot keep pace. Navigating directly to official websites, verifying download domains, never executing commands from shared AI conversations, and using a password manager with unique credentials remain the strongest protections we have.

As AI platforms continue to add sharing and collaboration features, this attack vector will only grow. The responsibility for safety increasingly falls on individual users to verify before they act. Share this guide with colleagues who use AI tools — the more people who understand the LLMShare technique, the harder it becomes for attackers to find victims.