A convincing fake ChatGPT download site, openew[.]app -- reached in part via an AI-generated fake outage page rendered on a real chatgpt.com/s/ URL --.
Social Engineering Examples·3 sources
In May 2026, Malwarebytes Threat Intel identified openew[.]app, a fake website closely impersonating OpenAI's ChatGPT download page, complete with matching dark-theme branding and separate download buttons for Windows and macOS. Visitors who clicked the Windows button received Chat_GPT.exe, a trojanized Inno Setup installer wrapping an Electron shell that dropped files under %APPDATA%LeronApplication, launched EApp.exe, displayed a CAPTCHA challenge to gate/delay sandbox analysis, then spawned PowerShell fed via stdin (`-ExecutionPolicy Unrestricted -Command -`) to run credential-stealing malware while beaconing to a hardcoded C2 (188.137.246.189).
Visitors who clicked the macOS button received ChatGpt.dmg, containing Odyssey Stealer, a fork of the well-known Atomic Stealer (AMOS) malware-as-a-service family. Odyssey used a fake macOS-style password prompt to phish the user's login password, then harvested the keychain, browser cookies/logins across 12 Chromium browsers plus Firefox/Waterfox, Telegram session data, and files from 16 cryptocurrency wallet directories.
Distinctively, it then downloaded trojanized replacements for Ledger Live, Ledger Wallet, and Trezor Suite and attempted to swap out the victim's legitimate wallet apps for the attacker's versions (using sudo if the password was captured, or rm -rf otherwise). Traffic to the fake site was driven via malvertising/search ads, SEO poisoning on ChatGPT-related and typo-squatted search terms, YouTube spam, and links in AI-focused Discord/Telegram communities.
Push Security separately published research (published 2026-05-29, one day after Malwarebytes) on a related, more novel technique it named "LLMShare": a Google Ads campaign directed victims to a genuine chatgpt.com/s/ shared-conversation URL where the attacker had prompted ChatGPT's own code-rendering feature to build a fully custom HTML/CSS page mimicking a ChatGPT "high traffic/service disruption" notice, AI-generated deceptive content rendered live on a legitimate, trusted OpenAI domain, which then redirected the victim to openew[.]app.
The domain openew[.]app cloned OpenAI's dark-themed ChatGPT download page, complete with OpenAI-style branding and marketing copy, and offered separate "official" download buttons for Windows and macOS, mirroring how legitimate cross-platform vendors ship installers, which made the dual-download setup feel authentic. Traffic was driven to the site via search ads and SEO poisoning on terms like "chatgpt," "chatgpt free," "chat gpt," and typo variants ("chatgo," "chatgot," "cvhatgpt"), plus YouTube spam comments and links shared in AI-focused Discord/Telegram communities.
Push Security separately documented a more sophisticated redirect chain, dubbed "LLMShare": Google Ads malvertising sent victims to a genuine, attacker-created chatgpt.com/s/ shared-conversation URL where the attacker had used ChatGPT's own code-rendering ("Show code"/"Remix with ChatGPT") feature to author and render a fully custom HTML/CSS page mimicking a ChatGPT "high traffic/service disruption" notice, AI-generated deceptive content served live from a legitimate, trusted OpenAI domain, which bypassed URL-reputation and Safe Browsing checks before the victim ever reached openew[.]app.
Because .app domains require HTTPS by registry policy, and because the LLMShare redirect step lived on a real chatgpt.com URL, victims saw a normal padlock icon with no certificate warning at either stage. Windows visitors downloaded Chat_GPT.exe, an Inno Setup installer wrapping an Electron app skeleton; on execution it dropped files under %APPDATA%LeronApplication, launched EApp.exe (the Electron shell), and displayed a CAPTCHA challenge to the victim, per Malwarebytes, used as an anti-sandbox/anti-automation gate to confirm a real human was running it before continuing, after which it spawned PowerShell with `-ExecutionPolicy Unrestricted -Command -`, feeding commands via stdin so they never touched disk for scanners to catch; the sample beaconed to 188.137.246.189 over a /laravel.php API endpoint (9 of 69 AV engines flagged it at analysis time). macOS visitors downloaded a disk image containing ChatGpt.dmg, delivering Odyssey Stealer, an AMOS (Atomic Stealer) fork available as malware-as-a-service.
Odyssey ran an AppleScript chain that first silently tested a captured/blank password against macOS directory-service commands, then, if that failed, displayed a fake system-style prompt ("Please enter device password to continue") to phish the login password in cleartext. It then exfiltrated the macOS keychain, cookies/saved logins from 12 Chromium-based browsers plus Firefox and Waterfox, Telegram session data, and files from 16 cryptocurrency wallet directories (Ledger Live, Trezor Suite, Exodus, Electrum, Sparrow, etc.) plus Desktop/Documents files with extensions like .wallet, .seed, .key, and .kdbx, compressing everything into an archive sent to a hardcoded server.
The lure was a near-pixel-perfect clone of OpenAI's own dark-themed ChatGPT download page, reached via sponsored/SEO-poisoned search results for "ChatGPT download" and close typo variants, YouTube spam, and links dropped in AI-enthusiast Discord/Telegram servers, with one distribution path (Push Security's "LLMShare") abusing a real chatgpt.com/s/ shared-chat URL to display an AI-generated fake "service overloaded" notice, built by prompting ChatGPT's own code-rendering feature, before redirecting out to the clone site.
The tell that should have stopped victims: ChatGPT does not require or officially distribute a third-party desktop installer from a random .app domain (the legitimate paths are chatgpt.com itself, native OpenAI apps, or the Microsoft Store); a "Show code"/"Remix with ChatGPT" toggle on a supposed system outage page is a giveaway that the page is user-generated content, not a real OpenAI status message; and mid-install, a generic-looking CAPTCHA gate followed by a macOS password prompt reading "Please enter device password to continue" is not how native macOS installer authentication looks.
Malwarebytes disclosed the campaign publicly on May 28, 2026, stating its products detect and block the malware, and Push Security published related independent research on the AI-generated redirect technique (LLMShare) on May 29, 2026. No confirmed victim count, breach scope, or aggregate financial loss was disclosed in the public reporting; the domain's takedown/registrar status and any law-enforcement action were not reported in the sourced material, and OpenAI had not issued a public statement on the abuse of its shared-conversation feature as of the cited reporting.
This case shows how attackers weaponize the hype around a specific, wildly popular AI product (ChatGPT) as bait, and how the pattern generalizes to any trending software: a convincing clone site, cheap malvertising/SEO placement, and a valid HTTPS certificate (even on a "trustworthy-looking" .app domain) can be enough to bypass a typical user's instinct to check for a green padlock.
The Push Security-documented redirect adds a further twist: attackers can now use an AI chatbot's own content-rendering and sharing features to generate and host a convincing fake system notice on the chatbot's own trusted domain, meaning the AI product itself becomes an unwitting delivery platform for AI-authored deceptive content, not just the impersonation target, a distinction from purely non-AI brand-impersonation lures.
It also illustrates an escalation beyond simple credential/data theft: the trojanized Ledger/Trezor wallet-replacement step turns a single infection into a persistent, ongoing cryptocurrency-theft mechanism that can silently intercept future legitimate wallet use, not just steal what's on disk at infection time. For a general audience, the key lesson is that "official-looking desktop app for [popular AI tool]" is an increasingly common lure precisely because so many users now expect AI products to have downloadable apps, and that even a page hosted on the real chatgpt.com domain is not automatically trustworthy content.
Malwarebytes states its products detect/block this malware. Practical defenses highlighted by the case: only download software from the vendor's official domain/app store (OpenAI's own chatgpt.com download page or the Microsoft Store) rather than search ads, unfamiliar results, or shared chatbot-conversation links; be suspicious of any "free desktop app" for a product that is primarily browser/mobile-based; note that a valid HTTPS padlock (including on trustworthy-sounding .app TLDs, and even a legitimate chatgpt.com URL itself) is not proof that the content on the page is genuine, since AI chatbot code-rendering/sharing features can be abused to host convincing fake system notices; treat any OS password prompt or CAPTCHA challenge that appears mid-install with suspicion, especially one styled generically rather than a native system dialog; verify that cryptocurrency wallet apps (Ledger Live, Ledger Wallet, Trezor Suite, etc.) were not silently reinstalled/replaced, and re-download wallet software directly from the hardware vendor if any compromise is suspected; enterprises can block/alert on PowerShell invoked with `-ExecutionPolicy Unrestricted -Command -` (stdin-fed scripting) and on the observed C2 indicator (188.137.246.189 /laravel.php endpoint).
Social Engineering Examples. “Fake ChatGPT Download Site (openew[.]app): SEO Poisoning, Malvertising, and an AI-Generated chatgpt.com Redirect Deliver Cross-Platform Infostealers with Wallet-Swap Payload”. Accessed 19 September 2026. https://socialengineeringexamples.com/fake-chatgpt-download-site-openew-app-2026
Attackers registered a fresh .app domain (openew[.]app), a gTLD that requires HTTPS by default, and used commodity webpage-cloning tools to reproduce OpenAI's real ChatGPT download page. They assembled the Windows loader from cheap, off-the-shelf components (a free Inno Setup installer wrapping a free Electron app shell) and rented Odyssey Stealer, a maintained macOS malware-as-a-service kit in the AMOS/Poseidon lineage, reportedly for around $3,000/month.
Domain registration and reuse of free, off-the-shelf installer tooling happen entirely outside any single victim organization's visibility and are hard to prevent up front. The nearest practical control is proactive brand-protection monitoring, automated scanning for new lookalike or typosquat domain registrations against a product's name, so a clone site can be flagged before it gains traffic, rather than trying to stop the registration itself.
Per Malwarebytes and Push Security, the operators drove victims to the fake site through several concurrent channels: search-engine malvertising and SEO poisoning targeting 'chatgpt,' 'chatgpt free,' and common typo variants; YouTube comment spam; links shared in AI-focused Discord and Telegram communities; and, per Push Security's LLMShare research, a Google Ads campaign pointing to a genuine chatgpt.com/s/ shared-conversation URL where the attacker had used ChatGPT's own code-rendering feature to author a fake 'high traffic' outage notice.
Ad-platform advertiser verification and landing-page review policies, DNS or web filtering against known malvertising and newly-registered domains, and search engines' own SEO-poisoning detection are the layered controls here. None are foolproof against a brand-new domain, so user habit, typing a known vendor URL rather than clicking an ad or search result, remains the most reliable individual-level defense.
Visitors reaching the fake outage notice or the openew[.]app clone site saw a normal HTTPS padlock at every stage, guaranteed by the .app TLD's forced-HTTPS policy and by chatgpt.com's own valid certificate for the LLMShare step. Per Push Security, the site also used conditional/cloaked rendering, showing the ChatGPT clone to real browsers while automated scanners such as URLScan were redirected to an unrelated, benign-looking site, hindering detection and takedown efforts.
Cloaked pages that show attackers' content only to real browsers are specifically designed to defeat automated scanners, so detection tooling alone cannot be relied on. The realistic control is user training to recognize that a valid HTTPS padlock, even on a trusted domain like chatgpt.com, only proves an encrypted connection, not that the page's content is legitimate, and that a real vendor does not gate a software download behind a 'high traffic' notice.
Visitors who clicked the Windows download button received Chat_GPT.exe, which dropped files under %APPDATA%LeronApplication, launched a secondary process, and displayed a CAPTCHA challenge that, per Malwarebytes, served as an anti-sandbox gate to confirm a real human, not automated analysis, was running it before continuing.
Application allowlisting or attestation, so unsigned or unrecognized installers cannot silently execute, combined with EDR/PowerShell logging rules that flag stdin-fed scripting invoked with -ExecutionPolicy Unrestricted -Command -, and network egress monitoring or blocking of the observed C2 indicator, would each have interrupted this stage.
Visitors who clicked the macOS button received ChatGpt.dmg, containing Odyssey Stealer. The malware ran an AppleScript chain that first silently tested any already-known password, then, if that failed, displayed a fake macOS-style system prompt reading 'Please enter device password to continue' to phish the user's real login password in cleartext.
User awareness that a legitimate macOS password prompt is a native system dialog, never one generated by a downloaded app immediately after installation, is the main defense. This pairs with only installing software from Apple-notarized sources or the vendor's own verified domain, so the malicious app never reaches the point of asking for the password at all.
On Windows, the loader spawned PowerShell fed via stdin to run credential-stealing commands while beaconing to a hardcoded C2 IP. On macOS, Odyssey harvested the keychain, browser cookies/logins across 12 Chromium browsers plus Firefox/Waterfox, Telegram session data, and files from 16 cryptocurrency wallet directories, compressing everything for exfiltration.
Browser and OS-level protections that limit blanket keychain or cookie access to individual apps, multi-factor authentication so a stolen password or session cookie alone is insufficient for account takeover, and treating any suspected infection as a signal to rotate credentials and sign out of sessions everywhere from a separate clean device, all reduce the value of harvested data.
On macOS specifically, after the initial theft, the malware downloaded trojanized replacements for Ledger Live, Ledger Wallet, and Trezor Suite and attempted to swap out the victim's legitimate wallet apps for the attacker's versions, using sudo if a password had been captured or rm -rf otherwise, turning a one-time infection into an ongoing interception point for future wallet use.
Hardware wallets that require a physical confirmation on the device itself for any outgoing transaction, verifying wallet-app integrity (checksums or confirming the app still matches the vendor's official listing) before opening it post-infection, and re-downloading wallet software directly from the hardware vendor if compromise is suspected, all blunt this step even after a successful swap.
Stolen credentials, cookies, and wallet/keychain data give the operators standing access to the victim's accounts and crypto holdings, and a successfully swapped wallet app lets them intercept future legitimate transactions. Per Malwarebytes, this is the likely profit driver behind the campaign and the reason the macOS malware-as-a-service tier commands a far higher rental price than comparable Windows stealers.
Once stolen credentials are used or a swapped wallet app intercepts a real transaction, losses are largely irrecoverable, so there is no meaningful control left at this stage. The realistic defense sits upstream, at Stage 7's hardware-confirmation requirement and Stage 6's rapid credential rotation, before monetization can occur.
Browse by what this case has in common with others in the library.
A caller posing as a Standard Bank representative persuaded 18-year-old Reabetswe Modisane to move her R438.
A small Columbus, Ohio manufacturer disclosed in a February 2026 SEC 8-K that it lost $898,325 to an imposter scam…
Google's GTIG and Ukraine's CERT-UA documented PROMPTSTEAL (aka LAMEHUG).
Scheme participants posed as veteran finance professionals inside private WhatsApp investment groups to lure at least 18 U.S. retail investors…
A Lapsus$ affiliate bought a contractor's stolen Uber password, flooded them with MFA push prompts, then posed as Uber IT…
A Taiwan-linked money courier was caught in an Austin bank sting while collecting part of the $1.4 million a victim…
The FBI, FTC, and USPIS each issued 2025 public warnings about "brushing 2.0" -- unsolicited packages containing QR codes that,…
DOJ/FTC alleged that Citizens Disability and subsidiary CD Media made 109 million-plus illegal telemarketing calls.
An Atlantic City woman posed as a life-insurance/retirement-benefit representative on burner-phone calls to recently widowed elderly victims.
A US Attorney's Office (EDVA) court order seized seven domains spoofing the Singapore International Monetary Exchange that pig-butchering scammers used.
Binance CCO Patrick Hillmann claimed scammers built an AI deepfake "hologram" of him from his TV interview footage and used…
Social Engineering Examples