A sophisticated new cyberattack campaign, dubbed LLMShare by security researchers at Push Security, is exploiting ChatGPT’s content sharing functionality to distribute malware through what appear to be legitimate OpenAI URLs. The campaign uses Google search ads to redirect users to genuine chatgpt.com/s/codecodecode share pages, where a fake maintenance screen — itself generated by ChatGPT — prompts visitors to download a desktop application that delivers infostealing malware. The technique marks a significant escalation in how attackers are weaponizing trust in AI platform infrastructure.
How Legitimate ChatGPT Share Links Become Malware Delivery Vehicles
The LLMShare campaign exploits a structural weakness in how AI platforms handle shared content. Attackers begin by purchasing Google search ads targeting keywords such as “ChatGPT,” “ChatGPT desktop app,” and “ChatGPT download.” When a user clicks one of these sponsored results, they land on a page at chatgpt.com/s/codecodecode — a legitimate ChatGPT share URL. But instead of displaying a normal conversation transcript, the page shows a fake maintenance notification styled to look like an official OpenAI alert.
“Access is concentrated,” the counterfeit page reads in a typical example. “Please download the desktop app and use it.” The page includes a prominent download button and bears all the visual hallmarks of an authentic system notification. Because the page is hosted on the genuine chatgpt.comcodecodecode domain, web filters, URL scanners, and DNS security tools see no reason to flag it. A user who checks the address bar and confirms they are on a real OpenAI URL would have no immediate reason to suspect foul play.
What makes this technique especially insidious is that the fake maintenance page is itself a product of ChatGPT. The shared link was created by an attacker who prompted the AI model to generate custom HTML and CSS that mimics an official system alert. The telltale signs are present for anyone who looks closely: the page retains the “Show code” and “Remix in ChatGPT” controls that appear on any shared ChatGPT output. The displayed content is not an official OpenAI page — it is a user-generated prompt response rendered on the platform’s shared content infrastructure.
The Download Chain: What Waits Beyond the Fake Alert
Clicking the “Download” button on the counterfeit page takes the user to openew[.]appcodecodecode, an external site that closely replicates the official OpenAI desktop application download page. The site offers download options for both macOS and Windows, each leading to a different malicious payload.
Security firm Malwarebytes analyzed the macOS variant and identified it as Odyssey Stealer, a malware family related to the Atomic Stealer (AMOS) lineage. This infostealer targets browser passwords and cookies, Telegram session data, and cryptocurrency wallet credentials. It also includes functionality to intercept legitimate hardware wallet applications from Ledger and Trezor, replacing them with tampered versions designed to capture recovery phrases and private keys.
The Windows variant is a malware loader that, upon execution, checks whether it is running inside a virtual machine. If it detects a physical machine, it proceeds to deploy the main payload. If it detects a sandboxed or virtualized environment, it remains dormant — a common anti-analysis technique designed to evade automated security systems.
The openew[.]appcodecodecode site includes an additional layer of deception: when accessed by security scanning platforms such as URLScan, it displays a harmless page belonging to an AR/VR company. This cloaking mechanism means that automated analysis tools and even some manual investigations may classify the site as benign, allowing the campaign to persist longer before detection.
A Growing Pattern: AI Platform Sharing Features as Attack Infrastructure
The LLMShare campaign is not an isolated incident. It belongs to a rapidly expanding category of attacks that exploit AI platform sharing features to bypass traditional security controls.
In December 2025, researchers at Kaspersky and Huntress reported that attackers were abusing ChatGPT and Grok shared chat links to distribute AMOS malware. Those campaigns disguised the malicious content as macOS setup guides and used a social engineering technique called ClickFix — also known as click-fix or fake error social engineering — in which users are instructed to paste a command into their terminal to resolve a fabricated issue.
In February 2026, Moonlock Lab and AdGuard identified a campaign abusing Claude’s artifact sharing feature. Attackers created a fake “macOS Knowledge Base” page hosted on Claude’s platform and used it to distribute MacSync Stealer, another infostealer targeting credential stores and cryptocurrency wallets.
Microsoft reported a multi-pronged campaign in May 2026 that used ClickFix techniques to simultaneously distribute Macsync, Shub Stealer, and AMOS through shared content hosted on AI platforms. The LLMShare campaign reported by Push Security in the same month represents the latest and most refined iteration of this attack pattern.
What all these campaigns share is a fundamental asymmetry: the attacker does not need to own or control the infrastructure that delivers the initial payload. The AI platform itself — a trusted, high-reputation domain — hosts the deceptive content. The attacker only needs to control the final command-and-control server, which can be discarded and replaced at minimal cost. Since the initial URL points to a legitimate domain, browser safe-browsing protections, DNS filtering, and even manual URL inspection all fail to raise alarms.
Why the AI Platform Sharing Model Is Structurally Vulnerable
The core problem is not a bug in ChatGPT, Claude, or Grok. It is a design property of how these platforms handle shared content. AI platform share links are transparent by design: the content is rendered directly from user-generated prompt outputs, and the platform does not assert editorial control over what those outputs contain. The platform hosts the content, but the content belongs to the user who created it.
This creates a blind spot for conventional security. A user who checks “Is this URL real?” will find that it is. A security tool that checks “Is this domain known for malware?” will conclude that it is not. A browser that checks “Has this URL been reported as phishing?” will likely find no entry — because the URL itself is temporary, share-specific, and disappears from the attacker’s control once the campaign shifts to a new link. The structural weakness is not that the platform is insecure; it is that the platform’s trust can be borrowed by anyone who knows how to ask the right questions.
What Users Can Do to Protect Themselves
Defense against this class of attack ultimately comes down to behavioral discipline. ChatGPT’s official desktop application should be obtained exclusively from OpenAI’s verified download page at openai.com/chatgpt/download/codecodecode or directly from the Microsoft Store. Any search ad that promises a “ChatGPT download” is almost certainly fraudulent — the official distribution channels do not rely on Google search ads to reach users.
When a shared link at chatgpt.com/s/codecodecode or chatgpt.com/share/codecodecode opens a page that looks like a system notification or a maintenance alert, that page is not an official communication from OpenAI. It is a ChatGPT-generated prompt response rendered on the platform. The presence of a “Show code” or “Remix in ChatGPT” button is the clearest indicator: official announcements do not include those controls. Shared content is user-generated, not platform-endorsed.
Most critically, no legitimate organization will ever ask a user to paste a command into their terminal or download a desktop application from a prompt-generated page. Any instructions that involve pasting code, executing commands, or downloading software from a shared AI chat output should be treated as immediately suspicious. The habit of verifying the source of content — not just the source of the URL — is the only reliable defense against this emerging class of attack.
The LLMShare campaign is a reminder that trust in digital infrastructure can no longer be binary. A domain can be legitimate while the content hosted on it is not. A URL can be real while the page it loads is deceptive. As AI platform sharing features become a standard part of how information spreads online, the distinction between platform and content will only become more important — and more dangerous to ignore.
