Signal
Attackers exploit ChatGPT shared content feature to spread malware
Evidence first: scan the strongest sources, then decide whether to go deeper.
Published 2026-06-01 09:30 UTCUpdated 2026-06-01 17:24 UTC
rss
malwarephishingthreat_actorssecurity_tooling
Trend in the last 24h
Source links open
Source links and full evidence are open here. Archive history, compare-over-time, alerts, exports, API, integrations, and workflow are paid.
No card needed for the free brief.
Evidence trail (top sources)
top sources (2 domains)domains are deduped. counts indicate coverage, not truth.2 top sources shown
limited source diversity in top sources
Overview
Security researchers at Push Security have identified a new phishing campaign dubbed "LLMShare" that abuses the shared content feature of ChatGPT. Attackers use Google advertisements to lure users searching for ChatGPT to malicious shared pages hosted under the official chatgpt.com domain, specifically within the /s/ path. This tactic allows the delivery of malware while leveraging the legitimacy of the domain to evade suspicion and increase the likelihood of successful infection.
Entities
Push SecurityLLMShare
Score total
0.81
Momentum 24h
2
Posts
2
Origins
2
Source types
1
Duplicate ratio
0%
Why now
- The campaign was recently discovered, indicating active exploitation.
- Use of official ChatGPT domain shows evolving attacker tactics.
- Heightened awareness can help users avoid phishing traps linked to ChatGPT.
Why it matters
- Attackers exploit trusted domains to increase malware delivery success.
- Users searching for ChatGPT are targeted via Google ads, increasing exposure.
- Malware hosted on official domains complicates detection and response.
LLM analysis
Topic mix: lowPromo risk: lowSource quality: medium
Recurring claims
- Attackers use ChatGPT shared content feature to deliver malware via phishing campaigns.
How sources frame it
- Push Security: neutral
All evidence
All evidence
Attackers use ChatGPT feature to spread malware
SC Media · scworld.com · 2026-06-01 17:24 UTC
Attackers Abuse Shared Content for ChatGPT Phishing Campaign
Infosecurity Magazine · infosecurity-magazine.com · 2026-06-01 09:30 UTC
Show filters & breakdown
Posts loaded: 0Publishers: 2Origin domains: 2Duplicates: -
Showing 2 / 0
Top publishers (this list)
- SC Media (1)
- Infosecurity Magazine (1)
Top origin domains (this list)
- scworld.com (1)
- infosecurity-magazine.com (1)