Malvertisers Use ChatGPT Share Links to Deliver Malware
Security researchers report a malvertising campaign that uses paid search ads to route victims to weaponized ChatGPT and AI-platform share pages delivering malware. Push Security disclosed on May 29, 2026 that attackers built pixel-perfect fake outage/download pages hosted on chatgpt.com/s/[id], and bought Google Ads for queries such as "ChatGPT download" to steer traffic to those share links (reported by TechTimes). The Cloud Security Alliance documented a parallel campaign abusing claude.ai share links to host macOS installation guides that run the MacSync infostealer, with initial identification attributed to Trendyol Group researcher Berk Albayrak (CSA research note, May 12, 2026). Evalian's SOC team also flagged a Windows-and-macOS campaign using convincing OpenAI branding and sponsored search results (ITSecurityNews). As of June 1, 2026, TechTimes reports neither OpenAI nor Anthropic had issued a public statement addressing the abuse.


















