Fake ChatGPT Ads Lead Users to Malicious Custom AI Tool

Cybercriminals are running sponsored Google advertisements that mimic legitimate ChatGPT links but redirect users to fraudulent custom GPT versions designed to distribute malware. The scam appears authentic because users remain logged into their actual ChatGPT accounts and see convincing interface elements, making detection difficult. Users are advised to verify URLs carefully and be cautious when clicking on sponsored search results.

Cybercriminals are exploiting Google's paid advertising system to distribute malware through fraudulent ChatGPT replicas. The scam leverages custom GPT configurations—user-created AI tool variations—that display fake service notices claiming limited availability. The deception succeeds because victims remain authenticated to their legitimate OpenAI accounts while interacting with the malicious version, creating a veneer of authenticity that masks the threat.

The attack chain culminates when users click embedded links directing them to phishing pages featuring fake security verification screens. These pages instruct victims to execute commands in their system terminals, delivering malware payloads. Security researchers note that legitimate cloud infrastructure companies would never request command execution through such mechanisms, yet the sophisticated presentation may convince less technical users.