LLMShare: how malware hides behind trusted AI share links

Social engineering · 6-min read · See what is being exploited → · updated August 2026

Here’s a phishing page where every tell your users were trained on fails: the URL really is chatgpt.com, the page really is on OpenAI’s infrastructure, and there’s no typo-squat to spot. It’s a real campaign — LLMShare, documented by Push Security in 2026 — and it works by borrowing a trusted domain’s reputation to serve malware.

How the attack works

The first hops are on a domain you trust — which is exactly why the lure gets through.

Why your defences miss it

The three tells that all fail: (1) the URL really is chatgpt.com, not a typo-squat; (2) the page really is on OpenAI infrastructure; (3) there’s no attacker-owned domain to flag. So URL-reputation checks and many corporate web filters wave it through — the malicious bit is content the platform hosts, not infrastructure anyone can blocklist.

The rules that still hold

Get apps from the source, not an ad

Install software from the vendor's own primary site, typed directly — never from a sponsored search result. Malvertising buys the top slot and points it at a lookalike. The ad position is not a trust signal.

Remember: outage pages never ask you to download anything

A genuine service outage is just unavailable. It does not offer a "desktop app" to keep going. Any "we're down — install this to continue" message is the lure, full stop.

A trusted domain is not a safe-content guarantee

Share and hosting links (chatgpt.com/s/, Notion, Google Drive, paste sites) let attackers host their own content on a reputable domain. The URL being real does not make the content safe — it just borrows the domain's reputation.

Verify the download before you run it

Check it came from the official app page and is correctly signed. An installer delivered via a share link or an ad redirect is a red flag, even if the first hop was a domain you trust.

If it ran, treat it as a compromise

The payload is an infostealer — it grabs passwords, session cookies and tokens. A password reset is not enough: rotate credentials, revoke active sessions, and run an EDR scan. (Same token-revocation logic as a device-code compromise.)

It won’t stay ChatGPT-only: the same trick works on any trusted share/hosting URL — Claude and Grok conversations have already been abused, and Notion, Google Drive and paste sites are the obvious next stops. The defence is the behaviour, not a blocklist.

Honesty note: this is a social-engineering / malvertising technique, not a software vulnerability — there’s no CVE to patch. IsItPatched focuses on whether the software you run is safe; this guide is here because the lure is current and the payload (an infostealer) ends in stolen credentials. If a user ran it, handle it like a compromise — and for flaws that are patchable, see what’s being actively exploited.

Turn this into action. Attackers host a fake "outage — download our desktop app" page on a real chatgpt.com share URL and drive traffic with Google Ads. Every phishing tell your users learned fails. How it works, why defences miss it, and the rules that still hold.

See what is being exploited — free →

Frequently asked questions

What is LLMShare?

LLMShare is a malware-distribution campaign first documented by Push Security in 2026. Attackers use ChatGPT's share / code-rendering feature to host a self-contained fake "service outage" page on a genuine chatgpt.com/s/ URL, then drive traffic to it with Google Ads. The page tells visitors to download a "desktop app" to keep using ChatGPT — the app is infostealer malware for Windows and macOS.

Why don't normal phishing defences catch it?

Because the usual tells all fail: the URL really is chatgpt.com (not a typo-squat), the page really is on OpenAI infrastructure, and there is no attacker-controlled domain to flag. It sails past URL-reputation checks and many corporate web filters precisely because it lives on a trusted domain.

Is the chatgpt.com link fake?

No — that is the point. The link is a real OpenAI share URL. The content on it is attacker-controlled, created with the platform's own page-rendering feature. Trusted domain, untrusted content.

What does the malware do?

Reported payloads are infostealers targeting both Windows and macOS — they harvest saved passwords, browser session cookies and authentication tokens, which let attackers log in as the victim without a password.

Does this only affect ChatGPT?

No. The same pattern works on any trusted share or hosting domain. Related campaigns have abused shared Claude and Grok conversations, and the technique generalises to Notion, Google Drive, paste sites and similar "trusted" share URLs — including ClickFix-style fake installation guides.

How do I protect my organisation?

Awareness is the main control: teach that outage pages never ask for downloads, that apps come from the vendor's own site (not ads), and that a trusted domain does not vouch for user-generated content on it. Where possible, restrict software installs and block known-bad download domains; treat any run as a credential compromise.

This guide is vendor-neutral and informational, grounded in publicly-available guidance from bodies such as OWASP, NIST and CISA. IsItPatched is independent and not affiliated with them, and this is not legal or compliance advice. See our disclaimer.

← Browse all guides · Security glossary →