ChatGPT Shared Content Abuse: Detecting Malicious chatgpt.com/s Campaigns

---
title: Potential ChatGPT Phishing Link Access
id: 9a8b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects access to the ChatGPT shared content path (/s/), which is currently being abused to deliver malware. Correlation with email logs is recommended to filter out legitimate internal sharing.
references:
  - https://www.infosecurity-magazine.com/news/attackers-shared-content-chatgpt/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: proxy
  product: null
detection:
  selection:
    cs-uri-query|contains: '/s/'
    c-uri|contains: 'chatgpt.com'
  condition: selection
falsepositives:
  - Legitimate sharing of ChatGPT conversations by employees
level: medium
---
title: Browser Process Downloading Content from ChatGPT Share
id: b1c2d3e4-5f6a-7b8c-9d0e-1f2a3b4c5d6e
status: experimental
description: Detects browser processes initiating network connections to the specific ChatGPT sharing path. This helps identify endpoints interacting with potentially weaponized links.
references:
  - https://www.infosecurity-magazine.com/news/attackers-shared-content-chatgpt/
author: Security Arsenal
date: 2025/04/08
tags:
  - attack.initial_access
  - attack.t1566.001
logsource:
  category: network_connection
  product: windows
detection:
  selection:
    Initiated: 'true'
    DestinationHostname|contains: 'chatgpt.com'
    DestinationPort: 443
  filter_path:
    DestinationUrl|contains: '/s/'
  condition: selection and filter_path
falsepositives:
  - Legitimate user usage of ChatGPT sharing features
level: low

// Hunt for ChatGPT shared content access
let TimeFrame = 1d;
DeviceNetworkEvents
| where Timestamp > ago(TimeFrame)
| where RemoteUrl contains "chatgpt.com" 
| where RemoteUrl contains "/s/"
| project Timestamp, DeviceName, InitiatingProcessAccountName, RemoteUrl, RemoteIP
| extend TLD = extract(@"https?://([a-z0-9.-]+)", 1, RemoteUrl)
| where TLD contains "chatgpt.com"
| sort by Timestamp desc

-- Hunt for ChatGPT shared links in browser history
SELECT * FROM foreach(
    glob(globs='*/Users/*/AppData/Local/Google/Chrome/User Data/*/History'),
    {
        SELECT 
            timestamp(url.last_visit_time / 1000000 - 11644473600) AS LastVisited,
            url.title AS PageTitle,
            url.url AS URL,
            path=Source
        FROM sqlite(file=Source, query="SELECT * FROM urls")
        WHERE URL =~ "chatgpt.com/s/"
    }
) UNION ALL SELECT * FROM foreach(
    glob(globs='*/Users/*/AppData/Local/Microsoft/Edge/User Data/*/History'),
    {
        SELECT 
            timestamp(url.last_visit_time / 1000000 - 11644473600) AS LastVisited,
            url.title AS PageTitle,
            url.url AS URL,
            path=Source
        FROM sqlite(file=Source, query="SELECT * FROM urls")
        WHERE URL =~ "chatgpt.com/s/"
    }
)

<#
.SYNOPSIS
    Scans browser history for interactions with ChatGPT shared links.
.DESCRIPTION
    Identifies potential exposure to the ChatGPT social engineering campaign
    by checking Chrome and Edge history for the /s/ path.
#>

$ErrorActionPreference = "SilentlyContinue"
$Users = Get-ChildItem "C:\Users" -Directory
$Results = @()

foreach ($User in $Users) {
    $ChromePath = "$($User.FullName)\AppData\Local\Google\Chrome\User Data"
    $EdgePath = "$($User.FullName)\AppData\Local\Microsoft\Edge\User Data"
    
    # Function to search SQLite history
    function Search-History {
        param($Path, $Browser)
        $HistoryFiles = Get-ChildItem -Path $Path -Recurse -Filter "History" -File -ErrorAction SilentlyContinue
        foreach ($File in $HistoryFiles) {
            $TempCopy = "$env:TEMP\temp_history_$(Get-Random).db"
            Copy-Item $File.FullName $TempCopy
            try {
                $Query = "SELECT datetime(last_visit_time/1000000-11644473600, 'unixepoch') as VisitedTime, url, title FROM urls WHERE url LIKE '%chatgpt.com/s/%'"
                Invoke-SqliteQuery -DataSource $TempCopy -Query $Query | ForEach-Object {
                    $Results += [PSCustomObject]@{
                        User        = $User.Name
                        Browser     = $Browser
                        VisitedTime = $_.VisitedTime
                        URL         = $_.url
                        Title       = $_.title
                    }
                }
            } catch {
                # Lock handled by copy, but SQLite module dependency required. Assuming Invoke-SqliteQuery is available or PSSQLite module loaded.
            } finally {
                Remove-Item $TempCopy -Force -ErrorAction SilentlyContinue
            }
        }
    }

    if (Test-Path $ChromePath) { Search-History -Path $ChromePath -Browser "Chrome" }
    if (Test-Path $EdgePath)   { Search-History -Path $EdgePath -Browser "Edge" }
}

if ($Results) {
    Write-Host "[!] Potential Threat Detected: ChatGPT Shared Links Found" -ForegroundColor Red
    $Results | Format-Table -AutoSize
} else {
    Write-Host "[+] No ChatGPT shared links found in browser history." -ForegroundColor Green
}

Update your Secure Web Gateway (SWG) or proxy configurations. If your organization permits generic AI usage, create a specific rule to block or require explicit authentication for the path `chatgpt.com/s/*`. Ideally, block file downloads originating from this specific path.