This new ChatGPT scam tricks you into installing malware

* A scam involves a sponsored Google link leading to a custom GPT offering information.
* The fake interaction mimics a "Service Availability Notice" regarding the primary domain.
* Some responses lead to a site hosted on Google Sites, not the actual ChatGPT domain.
* Following a specific link leads to a fake Cloudflare verification page.
* This page instructs users to paste and run a command in Windows/PowerShell.
* Running that command installs malware on the computer.
* A user attempted this process and received a response with a link leading to a scam.
* A separate attempt by an editor resulted in access to the normal ChatGPT site.
* Google deactivated some associated ad campaign accounts.

The pattern observed involves leveraging established trust—the familiarity of the ChatGPT brand and Google search results—to bypass critical evaluation. The attack shifts from simple misinformation (the fake error message) to direct system compromise (running malware via shell commands). This progression demonstrates a calculated escalation designed to maximize immediate user action through manufactured urgency and false security signals. The use of layered deception, where the initial lure appears legitimate while the final action demands a technical step, exploits the cognitive habit of seeking resolution from familiar systems. The core vulnerability is the hesitation between accepting convenience and verifying execution, especially when authority figures (like Google or OpenAI) are either slow to react or have established policies that do not immediately address novel threats like malvertising in this context.
Patterns detected: ARC-0043 Motte-and-Bailey, ARC-0045 Feature-to-Function Mismatch, ARC-0072 Authority Game