New online scam using ChatGPT's name; users at risk of malware

ChatGPT users are being targeted by a new online scam in which cybercriminals use deceptive messages to lure users toward links capable of installing malware on their computers.

According to reports, this scam appears when users search for ChatGPT on Google. A sponsored ad in the search results seemingly offers access to the official ChatGPT website; however, a "Custom GPT" hosted there displays a specific, fake message to the user in response to every query.

Deception via a Fake Service Notice

The message informs the user that service availability on the primary domain is limited. It then offers options to either upgrade to "ChatGPT Plus" or visit an alternative domain.

To make the scam appear more authentic, the user is kept on what looks like the genuine ChatGPT domain. If the user is already logged into their account, it appears to remain logged in normally, making it difficult to detect the fraud.

The fake Custom GPT is named "Plus 5.6," a title that might lead an average user to believe it is a new model or a feature related to ChatGPT Plus.

The Real Danger Lies in Opening the Link

Experts state that the most dangerous phase of the scam begins when the user clicks on the fake backup domain or any other provided link. Such links can redirect users to malicious websites, where—in addition to the risk of malware installation—there is a danger of sensitive information being stolen.

Users are advised not to blindly trust sponsored results appearing in Google searches. Similarly, one should avoid opening links contained in unexpected messages, such as "Service Availability Notice" alerts.

Downloading software or files from unknown websites can also prove risky; therefore, it is important to exercise caution regarding such links and downloads.