Fake ChatGPT Ads on Google Trick Windows Users Into Running Malware Commands, Researchers Warn

Fake ChatGPT ads on Google sent Windows users toward a malware trap that began with an ordinary search. Security researchers at Island say the campaign ran for about three months and ended in a fake verification page that told people to run a command on their own computers.

The ads were not hard to find. They appeared for searches such as “ChatGPT”, according to Island.

How the trap worked

The attackers did not build a fake website from scratch. Island says they created their own content using ChatGPT’s Custom GPT feature, then bought Google ads that led to it. Custom GPTs are user-built assistants that anyone can publish and share.

According to Island, the ads led to genuine chatgpt.com pages that carried attacker-written content. That detail matters. Checking the web address at this first step would have shown the real ChatGPT domain.

The trap opened only after a user typed a prompt. Instead of an answer, the person was shown a message about “high traffic” and pointed to a “backup domain”.

Where the verification page comes in

The backup domain led to a counterfeit ChatGPT and Cloudflare verification page. It told users to press Win+R, paste text from the clipboard and press Enter, supposedly to prove they were human.

Researchers call this technique “ClickFix”. The victim, not the attacker, runs the malicious command, so the person ends up doing the attacker’s work. The pasted command quietly downloads disguised malware.

Island’s analysis found behaviour consistent with NetSupport RAT, a remote-access tool that lets an attacker control a computer as if sitting at the keyboard. Reports on the research add that the malware can survive restarts and send data to attackers through a Telegram bot.

The campaign by the numbers

Island mapped the activity from late May through August 24, 2026.

The data has a limit. Island’s research shows the scale of the ad activity but not how many users were infected.

Researchers also saw the attackers rotate domains and use other Windows delivery routes. That suggests the operation did not depend on one disposable site.

A similar campaign from another firm

A separate report from security firm Huntress describes a related campaign. It found a Custom GPT called “Plus 5.6” designed to pass as an upgraded ChatGPT model, promoted through sponsored search results.

Huntress traced at least 40 incidents to the Google Sites page used as the bridge. It confirmed that only two began directly from the Custom GPT, so 40 should not be read as the number of Custom GPT infections. It also reported that a replacement lure appeared after the first one was removed.

The two reports describe similar methods, and I found nothing in the sources confirming they are the same operation.

How to protect yourself

Researchers point to one clear red flag. No genuine CAPTCHA or verification page should ask you to open Windows Run, paste a command or use PowerShell.

Other habits help:

• Open ChatGPT by typing the address or using a bookmark, not through a sponsored result.
• Treat a “backup domain” message as a warning sign.
• If you already ran such a command, disconnect from the internet, run a security scan and change important passwords from a different, clean device. Tell your IT team if it is a work machine.

The campaign did not exploit a software flaw. It relied on three trusted things at once: a search ad, a real ChatGPT address and a familiar verification screen.

That pushes the safety advice away from “check the link” and toward “check the request”. A real domain can still host a harmful page, so the better test is what the page asks you to do. The sources I reviewed do not include a response from Google or OpenAI, and the underlying problem of how easily people can publish and promote look-alike pages remains open.