Fake ChatGPT Site and Piracy Portals Deliver Cross-Platform Stealers and Cryptominers

Threat researchers reported two large malware distribution operations that relied on popular consumer lures rather than software exploits. One campaign used piracy sites offering movies, TV shows, books, and digital library content to push fake plugin or browser update prompts; the downloaded ZIP files abused DLL side-loading, ROP-based decryption, and reflective loading to install a modified SilentCryptoMiner, a watchdog, a RAT component, and CPU/GPU miners. The malware gated execution through DNS tunneling and date-generated command-and-control infrastructure, harvested host data, and established persistence with a fake GoogleUpdateTaskMachineQC service and repeated UAC elevation attempts, with implicated sites drawing roughly 40 million visits in a single month.

A separate operation used openew[.]app, a fake ChatGPT download page impersonating OpenAI, to infect both Windows and macOS users with platform-specific malware. Windows visitors received a credential-stealing loader disguised as Chat_GPT.exe, built with Inno Setup and Electron and launching PowerShell activity that contacted 188.137.246.189, while macOS users were served Atomic Stealer (AMOS) to steal passwords, browser data, Telegram sessions, and cryptocurrency wallet information. Researchers said the macOS payload also attempted to replace legitimate Ledger and Trezor applications with trojanized versions, underscoring a strong cryptocurrency theft motive and showing how attackers are exploiting AI-brand search traffic and piracy demand to scale malware infections.