Listen to this Post
Introduction: When Familiar Names Become Digital Weapons
The internet has reached a strange turning point where trust itself is being exploited as an attack vector. In a newly uncovered campaign, threat actors are abusing the global recognition of ChatGPT and OpenAI to lure users into downloading malware disguised as legitimate software. What looks like a simple search result becomes the entry point for a highly engineered infection chain targeting both Windows and macOS users. Behind the polished illusion of a “ChatGPT installer” lies a carefully constructed system designed to bypass defenses, evade detection, and silently compromise machines.
Summary of the Original Incident: A Deceptive Download Campaign in Plain Sight
Security researchers from Evalian’s Security Operations Center uncovered a malicious operation built around a fake ChatGPT download website hosted on the domain openew[.]app. The site was actively promoted through paid search advertising, meaning victims were not stumbling into it randomly but being deliberately guided there through sponsored results.
The campaign distributes trojanized installers for both Windows and macOS systems. These installers are not simple malware drops; they are wrapped in Electron applications, obfuscated JavaScript, staged execution flows, and CAPTCHA-based gating systems designed to confuse analysis tools and slow down automated detection.
Infrastructure analysis shows the attackers relied on fast-registered domains, low-cost VPS hosting, and rotating malicious assets, all pointing to a short-lived but scalable malware distribution pipeline.
How the Fake ChatGPT Site Tricks Users into Installing Malware
The attack begins with a convincing imitation of OpenAI branding. The domain openew[.]app is designed to resemble a legitimate download portal, pushing users toward what appears to be a ChatGPT installer.
Once accessed, users are guided through a seemingly normal download flow. However, beneath the surface, multiple evasion layers are active. JavaScript obfuscation hides malicious logic, while CAPTCHA screens serve as both a psychological trust signal and a technical filter to block automated sandbox systems.
The illusion of legitimacy is the core weapon here. Users are not forced into downloads; they are convinced.
Infrastructure Behind the Attack: Fast, Cheap, and Disposable
The malicious domain was recently registered through Namecheap and hosted using DNS infrastructure that is commonly associated with rapid deployment operations.
The associated IP address 144[.]172[.]104[.]205, hosted on RouterHosting LLC infrastructure, has been linked to similar malicious campaigns. This type of hosting is often abused because it is inexpensive, quickly provisioned, and frequently replaced.
Passive DNS analysis shows multiple related malicious domains tied to the same infrastructure, indicating a shared attacker ecosystem rather than a single isolated campaign.
Windows Malware: A Trojanized ChatGPT Installer
The Windows payload arrives as Chat_GPT.exe, packaged using Inno Setup and built on an Electron framework. At first glance, it resembles a legitimate application installer, but static analysis reveals multiple inconsistencies.
The embedded metadata identifies the software as “PovariEGLESVapp Setup,” completely unrelated to ChatGPT. Even more suspicious, the digital signature belongs to an unrelated entity, further confirming tampering.
Inside the package, App.exe triggers additional alerts, including heuristic detections labeling its behavior as abnormal. Once executed, it begins spawning PowerShell processes with unrestricted execution policies, effectively giving the malware full system control.
macOS Payload: Silent and Undetected by Security Tools
The macOS version of the malware presents a more concerning scenario. At the time of analysis, it returned zero detections across multiple antivirus engines.
This suggests intentional platform-specific tuning to avoid macOS security ecosystems. Attackers often prioritize stealth on macOS due to lower detection rates and delayed signature updates compared to Windows environments.
Obfuscation and Execution Flow: Inside the Electron App
Deep inspection of the app.asar archive reveals heavily obfuscated JavaScript code using hex encoding, dynamic function resolution, and control-flow distortion.
Despite the obfuscation, researchers identified critical Node.js modules including:
child_process for system command execution
fs for file manipulation
http for network communication
systeminformation for system profiling
zip-lib for payload handling
This confirms the malware has full operational access to system resources.
Execution is triggered only after CAPTCHA validation, followed by PowerShell execution chains that deliver the final payload.
A persistent Chromium profile is created under %APPDATA%\Satoshi, suggesting long-term persistence and potential data tracking.
Indicators of Compromise (IOCs)
openew[.]app — Fake ChatGPT download domain
144[.]172[.]104[.]205 — Malicious hosting infrastructure
SHA-256: 56CC26E88C064B0C423AA8AD6530E58F91D1E4D28FAB1A8BCEDEF16A6582B4D2 — Windows installer
SHA-256: D9AD44D43E57B870793FA5CF7FB3A813990D0CBD0C7087BDE70A5E61FB1F1FE6 — Electron payload
SHA-256: 7E5B708F6659B1FAD3AAE7B589A706434FBF21708AEEC5AF5910189B96E25FEF — macOS payload
%APPDATA%Satoshi — Persistent application profile path
Mitigation Strategies: How Organizations Can Defend Themselves
Security teams are advised to strengthen detection across post-execution behaviors rather than relying solely on perimeter blocking.
Key defensive measures include:
Monitoring executables launched from Downloads or Temp directories with misleading brand names
Detecting unusual PowerShell spawning from Electron or Chromium applications
Flagging newly created persistent profiles such as %APPDATA%\Satoshi
Blocking newly registered domains impersonating AI platforms
Validating installer metadata against digital signatures and publisher consistency
The campaign reinforces a critical truth: modern malware often bypasses traditional perimeter defenses entirely.
What Undercode Say:
Trust exploitation is becoming more dangerous than technical exploitation itself
Paid search ads are now a major malware delivery channel
CAPTCHA is increasingly used as a malicious gating mechanism, not just bot protection
Electron apps remain a double-edged sword due to system-level access
Obfuscation techniques are evolving faster than static detection engines
macOS is no longer a “low-risk” target environment
Attackers prioritize speed of deployment over long-term infrastructure stability
Low-cost VPS hosting continues to dominate malware campaigns
Fake installers are more effective than email phishing in some regions
Branding impersonation is now a core cybercrime strategy
Users trust search ads more than organic results
PowerShell remains a top post-exploitation tool
Staged payload execution reduces detection probability
CAPTCHA gating helps bypass automated sandboxing systems
Process tree monitoring is critical for detection
File metadata inconsistencies are strong early indicators
Code signing abuse is becoming more frequent
Cross-platform malware is increasingly common
Attackers prefer modular JavaScript-based payloads
Persistent Chromium profiles indicate long-term surveillance intent
Brand impersonation lowers user suspicion thresholds
Malware developers are optimizing for behavioral evasion, not signature evasion
Endpoint telemetry is more important than network filtering
AI-related branding is now a high-value lure vector
Users rarely inspect installer metadata
Social engineering now begins at search engine level
Fake software ecosystems are scaling rapidly
Malvertising bypasses traditional awareness training
Security awareness must include search behavior hygiene
Attack chains are becoming multi-layered and adaptive
Electron apps blur line between web and native threats
Dynamic function resolution hides malicious intent effectively
ZIP-based payload structures remain common delivery formats
Threat actors reuse infrastructure across campaigns
Rapid domain rotation reduces blacklist effectiveness
Endpoint detection must prioritize behavior over signature
Browser-based persistence is emerging as a major tactic
Cyber defense must adapt to advertising ecosystems
User trust remains the weakest security layer
Attackers are engineering deception, not just malware
❌ The campaign is not linked to official OpenAI infrastructure
✅ Malware indicators and hashes are consistent with trojanized Electron apps
❌ CAPTCHA does not guarantee safety; it is used here as a deception layer ✅ Use of PowerShell and staged execution is a verified malware behavior pattern
The technical details strongly align with known malvertising and trojan distribution methods. The infrastructure and execution flow are consistent with real-world phishing-to-malware pipelines rather than misinformation or speculation.
Prediction:
(+1) Malvertising campaigns impersonating AI tools will increase as public adoption of ChatGPT grows 📈
(+1) Cross-platform malware targeting both macOS and Windows will become the default standard
(-1) User trust in search ads will continue to decline as awareness spreads
Deep Analysis:
Linux Command Perspective:
ps aux | grep electron netstat -tulnp find / -name "Satoshi" 2>/dev/null journalctl -xe
Windows Command Perspective:
Get-Process | Where-Object {$_.ProcessName -like "Chat"}
Get-ChildItem $env:APPDATA
Get-WmiObject Win32_Process | Select-Object Name,CommandLine
macOS Command Perspective:
ps aux | grep "App" lsof -i find ~/Library/Application\ Support -name "Satoshi" spctl --status
Network Forensics:
nslookup openew.app whois 144.172.104.205 tcpdump -i any port 80 or port 443
Behavioral Insight:
Monitor PowerShell chain execution
Track Electron runtime anomalies
Correlate browser profile creation with installer execution
Flag CAPTCHA-protected download flows from ads
▶️ Related Video (78% Match):
🕵️📝Let’s dive deep and fact‑check.
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
References:
Reported By: cyberpress.org
Extra Source Hub (Possible Sources for article):
https://www.twitter.com
Wikipedia
OpenAi & Undercode AI
Image Source:
Unsplash
Undercode AI DI v2
🔐JOIN OUR CYBER WORLD [ CVE News • HackMonitor • UndercodeNews ]
📢 Follow UndercodeNews & Stay Tuned:
𝕏 formerly Twitter 🐦 | @ Threads | 🔗 Linkedin | 🦋BlueSky | 🐘Mastodon | 📺Youtube
