Fake ChatGPT ads show attackers abusing AI workflows, not just AI brands

From fake downloads to fake AI conversations

Earlier AI-themed malware lures often centered on counterfeit installers, browser extensions or downloadable “AI tools.” This cluster appears to mark a shift. The attacker-controlled path did not rely only on persuading users to download a fake ChatGPT application. Instead, users were reportedly steered through interactions that mimicked or abused AI product workflows, including a lure branded as “Plus 5.6.”¹⁴

Aardwolf Security argued that the case should challenge the habit of trusting a destination simply because it begins on a reputable domain. The concern is that if a user first encounters a lure through a legitimate chatgpt.com-hosted Custom GPT surface, conventional controls may treat the session as lower risk even when the conversation or prompt flow later points the user toward attacker-controlled infrastructure.²

That model matters because AI interfaces are increasingly treated as productivity layers, not ordinary websites. Users expect them to generate instructions, ask for confirmation and guide multi-step workflows. Attackers can exploit that trust by making malicious instructions feel like part of an interactive support or setup process rather than a classic phishing redirect.

The reported ClickFix path

Researchers described a familiar ClickFix pattern: a user lands on a verification-style page, often styled to resemble a Cloudflare check, and is instructed to perform manual steps that execute code locally.⁴⁶ In reported variants, the path involved fake CAPTCHA or verification prompts, PowerShell execution and Windows malware delivery.⁴

The post-click infection chain described by iTechGuides included MSI installation, DLL sideloading through signed host binaries, persistence and remote access trojan capabilities.⁵ Huntress-linked reporting cited by iTechGuides also described DLL sideloading and RAT delivery claims after the fake “Plus 5.6” lure moved users through the ClickFix sequence.⁴

ClickFix attacks are difficult for purely perimeter-focused defenses because they induce the user to become part of the execution chain. The malicious page may not need to exploit a browser vulnerability. Instead, it presents instructions that persuade the user to paste or run a command, shifting the decisive step from web content delivery to endpoint execution.

Why standard brand defenses may miss it

The campaign combined three trust signals that can weaken conventional detection: sponsored search placement, recognizable AI branding and legitimate web infrastructure. A user searching for an AI service may assume a sponsored result is vetted. A security stack may score a real platform domain as reputable. A fake verification page may resemble the routine anti-bot checks users see across the web.¹²³

That combination creates a problem for controls that look for single-point indicators. Blocking obvious typo domains may not catch a chain that starts with a paid ad and passes through a trusted AI surface. Reputation filtering may not flag the first interaction if it occurs on a legitimate domain. Brand monitoring may identify lookalike pages, but only after the campaign has moved across multiple ad IDs, landing pages and backup infrastructure.²³

Practitioner discussion on Reddit’s r/Malware also focused on the risk of sponsored-search results and the limits of initial-domain checks, with users pointing to ad blocking and greater skepticism of promoted links as practical mitigations.⁷ While community reaction is not a substitute for telemetry, it reflects a broader operational lesson: the first visible domain is no longer enough to determine whether the full user journey is safe.

Implications for security operations teams

Security operations leaders should treat AI-branded malvertising as a user-journey problem, not just a domain-blocking problem. The reported chain moved across ads, lookalike pages, Custom GPT-style interactions, Google Sites backup pages, fake verification pages and endpoint execution steps.¹³⁴ Each stage may look less suspicious in isolation than the complete sequence.

Detection teams should prioritize telemetry that connects the browser and endpoint layers. Useful signals include visits from sponsored search results to newly observed AI-themed domains, redirects from AI product pages to file-sharing or site-builder infrastructure, clipboard or command-paste behavior after a verification prompt, PowerShell launched from user-driven instructions, MSI execution after browser activity, and signed-binary DLL sideloading patterns.⁴⁵

Organizations should also review how their secure web gateways, endpoint detection tools and security awareness programs handle AI surfaces. A policy that allows trusted AI domains may still need controls for outbound links, prompt-delivered instructions and file execution paths. User guidance should emphasize that legitimate AI services and verification pages should not require copying commands into PowerShell or a Windows Run dialog to prove the user is human.

A broader shift in malware routing

The reported cluster points to a broader attacker adaptation. As AI platforms become routine work surfaces, their conversational and workflow features can be abused as routing layers. The brand lure remains important, but the larger development is the use of AI-style interaction to make the next malicious step feel authorized, contextual and normal.

For defenders, the lesson is to follow the chain rather than the logo. The campaign shows how paid ads, reputable domains and familiar verification designs can be combined to create a malware path that looks trustworthy until the user is asked to execute code. Security controls that correlate ad provenance, AI-session behavior, redirect paths and endpoint execution will be better positioned than controls that decide trust by domain name alone.