A series of malware is hiding behind ChatGPT
Facebook's parent company warns of a series of scams targeting users' curiosity about ChatGPT, which have appeared recently.
 |
ChatGPT impersonation scams are on the rise. Photo: Shutterstock. |
ChatGPT is a hot topic in the technology world. Cybercriminals are also "taking advantage" of this phenomenon to increase their fraudulent activities. Recently, Meta - the parent company of giant social networks such as Facebook and Instagram - has just pointed out the trick of exploiting ChatGPT to spread malware.
Sophisticated tricks
In a threat research report, Meta's security team said it discovered browser extensions and mobile apps that claimed to offer AI-powered chat, just as if users were visiting ChatGPT's official website directly.
Security experts found nearly 10 such applications and blocked more than 1,000 links containing malicious code, impersonating ChatGPT.
Notably, several browser extensions impersonating ChatGPT and bundling malware have appeared on official web app stores. Bad actors are also using paid search ads to market their malware-laden software. “From a bad actor’s perspective, ChatGPT is the new cryptocurrency,” said Guy Rosen, Meta’s chief security officer.
 |
Malware impersonating ChatGPT software. Currently, OpenAI only provides this tool directly on their website. Photo: FB. |
More sophisticated, some malicious tools offer ChatGPT's actual functionality in a limited way to avoid suspicion, making it harder for the average internet user to detect. ChatGPT is not the only AI product being abused by cybercriminals. Bad guys have also targeted Bard, a similar chatbot provided by Google.
As of now, ChatGPT is officially available only through OpenAI's website. They have not released any software, mobile apps, or browser extensions.
A series of warnings
Meta's security report isn't the first to raise alarm about cybercriminals using ChatGPT as a disguise to scam users.
In March,The Hacker Newsreports of an extension called "Quick Access to ChatGPT" lurking on Google's Chrome Web Store. The fake extension can do some serious damage, like hijacking Facebook business accounts and using them to run ads.
 |
An extension that provides ChatGPT functionality has appeared on the Chrome app store. Photo: The Hacker News. |
Security expert Nati Tal ofGuardio Labspublished analysis showing that there are thousands of fake ChatGPT extension installations every day, helping bad actors siphon money using ads pushed by these stolen Facebook accounts.
Google's ecosystem isn't the only place where scams have emerged that capitalize on ChatGPT's popularity. Alex Kleber, a researcher atPrivacy 1sttrawled the Mac App Store and discovered an alarming number of apps claiming to offer the ChatGPT utility, with some shady features like perpetual subscription, source code duplication, and questionable developer profiles.
In addition, researchers at cybersecurity firmCheck PointIt also warned that cybercriminals have been using ChatGPT to encrypt malware, write highly convincing phishing emails to trick users.
An anonymous hacker on a hacker forum detailed how they used ChatGPT to encode a malware strain that was capable of finding target files on a computer, compressing them, and transmitting them to a remote server.
It is difficult to predict all the ways in which hackers will abuse ChatGPT for criminal activities. For now, to ensure safety, users should only use the tools provided by OpenAI through their official website.
