iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
Island researchers reported a campaign in which sponsored Google results for ChatGPT led users through attacker-authored content on genuine ChatGPT pages to a counterfeit verification site. That site tried to persuade Windows users to run a command that downloaded malware. Island counted about 850 paid-ad landings across the broader delivery cluster—not 850 infections.
How the fake ChatGPT ad campaign worked
In a report dated October 1, 2026, Island researchers Shachar Gritzman and Naveh Talmon Chvaicer described a route that began with sponsored search ads for queries such as “chatgpt.” The reported chain worked as follows:
- A user clicked a sponsored Google result.
- The ad led to attacker-authored Custom GPT or shared-chat content hosted on genuine chatgpt.com routes.
- In confirmed cases, unrelated prompts returned the same message, claiming high traffic and directing the user to a “backup domain.”
- That domain opened a counterfeit ChatGPT and Cloudflare verification page.
- The page used ClickFix social engineering: it urged the user to open Windows Run and paste a command as a supposed human-verification step.
Island’s isolated analysis of the command’s delivery behavior found activity consistent with NetSupport RAT, including persistence-related behavior, code injection, and communication through the Telegram Bot API. The report also describes separate MSI and WebDAV delivery branches; it does not establish those as sequential steps in the same confirmed chain.
What the 850+ figure does—and does not—mean
Island’s measurements cover observations from late May through August 24, 2026. They describe activity across the broader delivery cluster, not a count of infected people or successful malware executions.
| Island’s measure | What it represents |
|---|---|
| About 850 | Paid-ad landings observed in the broader delivery cluster |
| 26 | Lookalike ChatGPT destinations identified |
| 71 | Google Ads campaign IDs observed |
Island said only a small subset of the destinations was confirmed to serve the exact “backup domain” lure. Its report does not establish how many users were infected. The figures should therefore not be read as 850 victims, 850 malware downloads, or proof that every destination showed the same verification page.
Why a genuine ChatGPT page did not make the content safe
The reported route used attacker-authored material hosted on genuine ChatGPT pages before sending users elsewhere. A legitimate platform address confirms the domain, not that every prompt, shared chat, or instruction on it is trustworthy. Island’s report says the campaign did not require a vulnerability in ChatGPT or Google: the described tactic relied on paid ads, misleading content, and a user being persuaded to run a command.
#1 Best Overall
![Norton 360 Deluxe 2027 Antivirus, 3 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41qw3FS3qLL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 3 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
The warning sign Windows users should recognize
A webpage asking you to open Windows Run and paste a command to prove you are human is a serious red flag. A verification or CAPTCHA prompt should not require you to execute a command supplied by a webpage. In the campaign Island analyzed, that action was used to retrieve a PowerShell loader.
Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteWindows Errors? Fix Them Before They Spread
Repair common Windows errors and clear accumulated junk for a smoother, more stable PC - no reinstall needed.Free scan · no reinstall- Do not run commands copied from a webpage as a verification step.
- For a direct visit to ChatGPT, type the official address yourself rather than relying on a sponsored search result. This avoids the specific ad-to-lure route Island described, but is not a guarantee against other threats.
- Do not assume that a destination is safe just because an earlier page used the real chatgpt.com domain.
What is known about the campaign’s current status
Island’s observations ended August 24, 2026, and its report was published October 1. The cited reporting does not verify whether the ads or domains remain live now, or how many people encountered or acted on the lure. Its findings and counts are Island’s reported measurements, not independently audited Google statistics.
Quick Recap
Best Value
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Rank #4
- SPEED-OPTIMIZED, CROSS-PLATFORM PROTECTION: World-class antivirus security and cyber protection for Windows (Windows 7 with Service Pack 1, Windows 8, Windows 8.1, Windows 10, and Windows 11), Mac OS (Yosemite 10.10 or later), iOS (11.2 or later), and Android (5.0 or later). Organize and keep your digital life safe from hackers
- SAFE ONLINE BANKING: A unique, dedicated browser secures your online transactions; Our Total Security product also includes 200MB per day of our new and improved Bitdefender VPN
- ADVANCED THREAT DEFENSE: Real-Time Data Protection, Multi-Layer Malware and Ransomware Protection, Social Network Protection, Game/Movie/Work Modes, Microphone Monitor, Webcam Protection, Anti-Tracker, Phishing, Fraud, and Spam Protection, File Shredder, Parental Controls, and more
- ECO-FRIENDLY PACKAGING: Your product-specific code is printed on a card and shipped inside a protective cardboard sleeve. Simply open packaging and scratch off security ink on the card to reveal your activation code. No more bulky box or hard-to-recycle discs. PLEASE NOTE: Product packaging may vary from the images shown, however the product is the same.
Rank #3
![Norton 360 Deluxe 2027 Antivirus, 5 Devices, Auto-Renews [Download]](https://m.media-amazon.com/images/I/41IYV5zGyCL._SL160_.jpg)
- ONGOING PROTECTION Download instantly & install protection for 5 PCs, Macs, iOS or Android devices in minutes!
- TOP-PERFORMING VPN Faster speeds, more server locations, and greater connection control to protect your privacy across all your devices, including Smart TVs.
- ADVANCED SCAM PROTECTION Help spot hidden scams online. With the built-in Genie AI assistant, you’ll never wonder if a message or email is suspicious again.
- REAL-TIME PROTECTION Advanced security protects against existing and emerging malware threats, including ransomware and viruses, and it won’t slow down your device performance.
- DARK WEB MONITORING Identity thieves can buy or sell your information on websites and forums. We search the dark web and notify you should your information be found.
Rank #2
- THREAT DETECTION – Stay one step ahead. Suspicious links, risky sites, viruses, and scams, caught automatically before they reach you.
- PERSONAL INFO PROTECTION – Keep your personal info safer. Identity monitoring watches for your exposed info and tells you what to do about it.
- SECURE CONNECTIONS – Just a few easy clicks, and we'll automatically protect your info on public Wi‑Fi, every time you connect.
- GUIDED ACTION – Know what matters and what to do next. Clear alerts and simple guidance make it easy to take action.
- MORE THAN ANTIVIRUS – Scam protection, identity monitoring, VPN, web protection, and antivirus work together to protect you, all in one place.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
