Sponsored ChatGPT Search Results Funnel Users Into a PowerShell Malware Trap

A malware-distribution scam uses sponsored Google search results for ChatGPT to steer users to a malicious custom GPT hosted on the genuine ChatGPT domain, ZDNET reported. Named “Plus 5.6,” the custom GPT repeatedly claims that the main service is unavailable and offers a purported backup link. That link takes users to a Google Sites page impersonating Cloudflare verification, where they are instructed to paste and execute a Windows/PowerShell command that installs malware. The attack exploits trust in legitimate hosting platforms and familiar brands rather than relying solely on an obviously fraudulent domain.

The reporting does not identify the malware family, campaign scale, or confirmed victims. Google’s 2025 Ads Safety Report provides broader context on advertising safety, but the supplied reference does not establish a connection to this campaign. Organizations should warn employees that sponsored results and links supplied by custom GPTs are not assurances of legitimacy, encourage direct navigation to ChatGPT.com, and flag any supposed verification process that asks users to execute commands. Users should never run unfamiliar commands supplied by a webpage or chatbot.