New Fraud Utilizing ChatGPT Poses Malware Risk

A Dell laptop with a blue desktop screen on a white surface — Erick Cerritos / Unsplash

A new type of fraud utilizing ChatGPT has emerged, potentially leading users to unknowingly install malware on their PCs. Reports have surfaced in recent days of users encountering strange interactions while using ChatGPT. A message labeled "Service Availability Notice" appears, stating, "Currently, access to the main domain is restricted. To proceed, please select one of the following methods."

This message prompts users with an offer to upgrade to a "Plus" subscription and provides links to alternate domains. The article aims to explain the mechanics of this scam and how to prevent falling victim to it.

The scam begins when users search for "ChatGPT" on Google. In most cases, sponsored search results, or paid advertisements, appear above the actual search results. Clicking on what appears to be a legitimate link to the real ChatGPT site redirects users to a custom GPT instead. A custom GPT refers to a version of ChatGPT created by users for specific purposes. In this scam, the custom GPT is designed to return the aforementioned service availability notice regardless of the input.

The link in the notice leads to a free site hosted on Google Sites, which is not affiliated with the ChatGPT domain. When clicked, a fake "Cloudflare" authentication screen appears, instructing users to paste and execute a command in "Windows" "PowerShell." Executing this command results in malware being installed on the computer.

To avoid falling victim to this scam, specific methods are recommended along with general advice for ensuring online safety. Users should input "chatgpt.com" directly into the browser instead of searching for "ChatGPT" on Google. It is advised not to click on sponsored Google links and to exercise caution when encountering search result advertisements, as these have been misused repeatedly in the past. Google itself utilizes "Gemini" to detect and block malicious advertisements.

Users must never execute commands they do not understand on their computers. Special care should be taken if such instructions are present in links or pop-up windows.