ChatGPT Share Link Abuse: Fake Outage Pages and Malware Delivery — Detection and Remediation

---
title: Potential Malware Download Initiated from ChatGPT Share Link
id: 8d4c2b1a-9e3f-4a5c-8d6e-1f2a3b4c5d6e
status: experimental
description: Detects network connections to ChatGPT share links followed by a file download event. This anomaly suggests a user may have been phished into downloading a payload from a fake outage page.
references:
  - https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.initial_access
  - attack.t1566.002
logsource:
  category: network_connection
  product: windows
detection:
  selection_share:
    DestinationHostname|contains: 'chatgpt.com'
    DestinationHostname|contains: '/c/' # Share links often contain this path structure or similar UUID patterns
  selection_download:
    Initiated: 'true' # Indicates an outbound connection
  filter_legit:
    DestinationPort: 443
  timeframe: 5m
  condition: selection_share and selection_download | near selection_download by filter_legit
falsepositives:
  - Legitimate interaction with ChatGPT shares (downloads are rare from this specific context).
level: medium
---
title: Execution of Suspicious Masqueraded ChatGPT Installer
id: 1a2b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects the execution of processes with filenames masquerading as the ChatGPT desktop application or installer. Legitimate versions should be verified via digital signature.
references:
  - https://www.bleepingcomputer.com/news/security/chatgpt-share-links-abused-to-host-fake-outage-pages-to-deliver-malware/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.execution
  - attack.t1204.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - '\chatgpt_setup.exe'
      - '\chatgpt-installer.exe'
      - '\chatgpt_desktop.exe'
      - '\openai_installer.exe'
  selection_parent:
    ParentImage|endswith:
      - '\explorer.exe'
      - '\chrome.exe'
      - '\msedge.exe'
      - '\firefox.exe'
  condition: selection_img and selection_parent
falsepositives:
  - Official installation of the ChatGPT desktop application (if deployed in the environment).
level: high

// Hunt for suspicious process creation involving masqueraded ChatGPT installers
// Correlates with network connections to ChatGPT share links to identify potential victims.
let TimeRange = 1h;
let SuspiciousProcesses = DeviceProcessEvents
| where Timestamp > ago(TimeRange)
| where FileName has_any ("chatgpt", "openai") and FileName endswith @".exe"
| where ProcessVersionInfoCompanyName != "OpenAI, Inc." // Detect binaries not signed by OpenAI
| project Timestamp, DeviceId, FileName, SHA256, ProcessVersionInfoCompanyName, AccountName;

let ChatGPTShareTraffic = DeviceNetworkEvents
| where Timestamp > ago(TimeRange)
| where RemoteUrl contains "chatgpt.com" and RemoteUrl matches regex @"\/c\/[a-f0-9-]+"
| project Timestamp, DeviceId, RemoteUrl, InitiatingProcessAccountName;

// Join network activity with process execution to find the attack chain
ChatGPTShareTraffic
| join kind=inner SuspiciousProcesses on DeviceId
| where (Timestamp1 - Timestamp) between (0min..10m) // Process executed shortly after visiting the link
| project Timestamp, DeviceId, RemoteUrl, SuspiciousFile = FileName, FileHash = SHA256, Account = InitiatingProcessAccountName, Signer = ProcessVersionInfoCompanyName
| order by Timestamp desc

// Hunt for recently created or modified executables with ChatGPT-related names in user directories
// This targets the payload drop regardless of how it was downloaded.
LET FileList = SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:/Users/*/Downloads/*chatgpt*.exe")
UNION SELECT FullPath, Mtime, Atime, Size, Mode
FROM glob(globs="C:/Users/*/AppData/Local/Temp/*chatgpt*.exe")

SELECT FullPath, Mtime, Size,
       upload(file=FullPath, name=basename(path=FullPath)) AS UploadedHash
FROM FileList
WHERE Mtime > now() - 7d

# Remediation Script: Quarantine Suspicious ChatGPT-themed Binaries
# This script scans user download/temp directories for unsigned executables matching threat patterns.

$QuarantinePath = "C:\Quarantine\ChatGPT-Threat"
$LogPath = "$env:TEMP\ChatGPT_Remediation.log"
$SuspiciousNames = @("*chatgpt*.exe", "*openai*.exe")
$DateThreshold = (Get-Date).AddDays(-7)

function Write-Log {
    Param ([string]$Message)
    Add-Content -Path $LogPath -Value "$(Get-Date -Format U) - $Message"
    Write-Host $Message
}

if (-not (Test-Path $QuarantinePath)) { New-Item -ItemType Directory -Path $QuarantinePath -Force | Out-Null }

Write-Log "Starting scan for suspicious ChatGPT binaries..."

Get-ChildItem -Path "$env:USERPROFILE\Downloads", "$env:TEMP" -Include $SuspiciousNames -Recurse -ErrorAction SilentlyContinue | ForEach-Object {
    $File = $_
    if ($File.LastWriteTime -gt $DateThreshold) {
        $Signature = Get-AuthenticodeSignature -FilePath $File.FullName
        # Check if file is unsigned or not signed by OpenAI
        if ($Signature.Status -ne 'Valid' -or $Signature.SignerCertificate.Subject -notmatch "O=\"OpenAI\"") {
            Write-Log "THREAT DETECTED: $($File.FullName) | Signer: $($Signature.SignerCertificate.Subject)"
            try {
                Move-Item -Path $File.FullName -Destination "$QuarantinePath\$($File.Name)" -Force
                Write-Log "Quarantined: $($File.Name)"
            } catch {
                Write-Log "Failed to quarantine $($File.FullName): $_"
            }
        }
    }
}
Write-Log "Scan complete. Review $QuarantinePath."