Fake ChatGPT Outage Pages Are Spreading Malware

A campaign called LLMShare hides malware behind fake ChatGPT “outage” pages hosted on OpenAI’s real chatgpt.com domain. Because the link is genuine, corporate web filters let it through. Victims arrive via Google ads, see a fake “high traffic” notice, and download a poisoned “desktop app” that installs stealer malware.

Security researchers at Push Security have documented a malware campaign that turns one of the most trusted addresses on the internet into a delivery mechanism. The trick is not a software bug. It is the address bar — and that is exactly why it works.

What is the LLMShare campaign?

LLMShare is a malware-distribution campaign, first reported by Push Security in late May 2026, that abuses ChatGPT’s content-sharing feature to serve fake OpenAI outage pages. According to Push Security, attackers buy Google ads targeting searches like “ChatGPT,” “ChatGPT desktop app,” and “ChatGPT download,” then route clicks to a malicious shared page hosted on the legitimate chatgpt.com domain.

Instead of showing a chat conversation, the shared page renders a fake service-disruption notice. BleepingComputer reported the message reads, “We’re experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue.” The button below it sends victims to openew[.]app, a clone of OpenAI’s real download portal, which serves malware for both Windows and macOS.

The clever part is how the page is built. Push Security found it includes “Show code” and “Remix with ChatGPT” controls — the giveaway that the outage notice is not an official OpenAI message at all, but custom HTML and CSS generated by a ChatGPT prompt and published through the share feature. As Push researcher Keanu Maharaj put it, the attacker used ChatGPT’s code-rendering feature to create “a fully designed, self-contained web page.”

Why does malware on chatgpt.com slip past your defenses?

It slips past because the malicious content lives on a domain your security stack already trusts. Phishing usually relies on a lookalike domain or a URL that’s one letter off — the signals filters and trained employees are taught to catch. Here there is no lookalike. The lure sits on the real chatgpt.com, served over a valid certificate, on a domain most corporate allowlists wave straight through.

That design also means there is no patch coming. As TechTimes noted, the technique exploits a product feature — public conversation sharing — not a vulnerability, so OpenAI cannot simply close it without changing how sharing works. As of June 1, 2026, neither OpenAI nor Anthropic had issued a public statement on the abuse of their sharing features, per reporting from gHacks and TechTimes.

The campaign also uses cloaking. Push Security found that when security scanning platforms such as URLScan visited the download site, they were shown a harmless AR/VR company page instead of the malware portal — so automated analysis sees something benign while the targeted human gets the payload.

Why this matters to your business

It matters because the malware being delivered is built to steal, and your existing controls are likely to miss it. While the final payloads vary, Push Security notes that earlier campaigns abusing AI-platform sharing have distributed infostealers — malware that harvests saved passwords, session cookies, and browser-stored credentials. One stolen session token can hand an attacker access to email, cloud consoles, or your SaaS stack without ever tripping a password reset.

This is not limited to ChatGPT. Security Boulevard and gHacks both reported that similar abuse has been observed on Anthropic’s Claude, including its sharing and Artifacts features, and on Grok. The common thread is trust: attackers are deliberately routing through AI platforms because users — and security tools — extend those domains a benefit of the doubt that a random URL would never get.

For a mid-market company, the exposure is straightforward. Employees install AI tools faster than IT can vet them, often by searching for the download themselves. That search-and-install habit is precisely the behavior LLMShare is built to ambush.

How a vCISO would triage this

A virtual Chief Information Security Officer (vCISO) would treat this less as a malware incident and more as an AI-governance gap, because that is where the real exposure sits. The first move is not to block chatgpt.com — that breaks a tool people now rely on and pushes usage further into the shadows. The first move is to find out how AI tools are actually entering the organization and who is installing desktop clients.

The reason matters: this campaign defeats the two controls most companies lean on — domain reputation and URL filtering — by design. So the practitioner question shifts from “is the domain safe?” to “does anyone need to be installing a desktop AI client at all, and from where?” Most knowledge workers use the browser version and never need a downloaded app. That single fact narrows the attack surface dramatically once it’s turned into policy.

This is the kind of judgment call where a vCISO or fractional CISO earns their keep — setting a defensible AI-tool policy that reduces risk without driving employees around it. The coverage of LLMShare has focused on how the trick works; the part most of it misses is that the durable fix is governance, not a detection signature.

What businesses should do?

Start with the human pathway, since that is what the campaign exploits. Concrete steps for this week:

•       Tell employees that AI desktop apps should only be installed from a vendor’s official, IT-verified link — never from a search-ad result or a shared chat page, even one on chatgpt.com.

•       Confirm which AI tools are actually approved, and decide whether desktop clients are needed at all when the browser version does the same job.

•       Make sure endpoint detection is set to catch infostealer behavior and unexpected installers, not just known-bad domains — because the lure domain here is trusted.

•       Treat credential and session-token theft as the likely impact: prioritize multi-factor authentication on email and cloud admin accounts, and shorten session lifetimes where you can.

•       Add “shared AI content is untrusted user-generated content” to security awareness training — a rendered page on an AI domain is not an official message from that vendor.

None of this requires new tooling. It requires a decision about how AI tools are governed in your environment, and someone accountable for enforcing it.

Frequently asked questions

Are ChatGPT share links dangerous?

A ChatGPT share link (the chatgpt.com/s/ format) is not inherently malicious, but it can display attacker-controlled content rendered by a prompt, including fake login or download pages. Treat shared AI pages the way you’d treat any user-generated content: the fact that it loads on a trusted domain does not make the content official or safe.

Will blocking chatgpt.com fix this?

No, and it usually backfires. Blocking the domain breaks legitimate ChatGPT use and pushes employees onto personal devices or unmanaged accounts, which is worse for visibility. The more effective control is governing how AI desktop apps get installed and where from, rather than blocking the platform outright.

Does this affect other AI tools besides ChatGPT?

Yes. Security Boulevard and gHacks reported similar abuse of Anthropic’s Claude — including its sharing and Artifacts features — and of Grok. The underlying tactic is platform-agnostic: any AI tool that lets users publish shareable, rendered content on a trusted domain can be abused the same way.

How do I know if an employee downloaded the fake app?

Look for desktop “ChatGPT” or AI-client installers that did not come from the vendor’s official domain, unexpected executables from domains like openew[.]app, and signs of credential or session-token theft such as logins from new locations. Endpoint detection and response (EDR) tooling and identity logs are where this surfaces — a risk assessment can confirm whether your monitoring would actually catch it.

Get help governing AI tools before they bite

LLMShare is a preview of where attacker tradecraft is heading: abusing the trust we extend to AI platforms rather than breaking them. Defending against it is less about a single patch and more about a clear, enforceable policy for how AI tools enter and operate inside your business. If you want a second set of eyes on your AI-tool governance and whether your defenses would catch a trusted-domain attack, Purple Shield Security works with mid-market and regulated firms as an independent advisor to put that policy in place — no products to sell, no vendor kickbacks.

By Yonatan Hoorizadeh — CISSP, CISM, CRISC, AAISM

Published By: Purple Shield Security

Published: June 8, 2026

Last updated: June 8, 2026