EN
ChatGPT is everywhere in the news lately, understandably as its ingenious uses appear limitless. In our previous two articles, we covered the what and how, and also the effects of ChatGPT on children and education.
Unfortunately however, it’s not all positives: the chatbot can also be used to write malicious coding and create viruses, while researchers have also warned that cybercriminals can use ChatGPT to compose the text for phishing emails at a fraction of the cost — meaning more phishing emails and more cyber threats. Then there’s the problem of fake ChatGPT apps and websites.
Have you seen people using the hashtag #LilyCollinsHack on social media recently? Its widespread sharing stems from Facebook users having their accounts hacked, and their names/profile pictures changed to resemble actress Lily Collins’s account. Reports state that over 4 million accounts have been affected – the number is so high because the attack commenced after victims were duped into downloading fake ChatGPT apps that were disguised as Chrome extensions.
Using fake ChatGPT apps in order to steal personal credentials is a known recent tactic used by hackers and cybercriminals, and this latest event is just the tip of the iceberg.
Victims discussing #LilyCollinsHack on Reddit.
In our investigations, we have found that there is a proliferation of fake ChatGPT apps. It is important to note that there is currently NO official ChatGPT app, neither is there a download — it is ONLY available on the official webpage.
We have tracked various suspicious ChatGPT apps, some being malicious Trojan viruses and others PUAs (“potentially unwanted app”). PUAs are not considered malware, but still pose a lower security and privacy risk: they result in your device’s operating system slowing down, or in the appearance of unexpected and intrusive ads.
Trojan apps have the capacity to install malicious software onto your device, and even to encrypt your data/device. A trojan is a nasty malware type that can put users, user data, or devices, at high risk of serious damage. The ChatGPT trojan apps we have discovered are in fact not new — but merely under a new disguise. Previously, they were listed as YouTube and Netflix “premium” apps (also fake).
The “ChatGPT” trojan app discreetly subscribes its target to various premium services through SMS billing fraud. While the “AI photo” trojan app belongs to the Spynote malware, which can be used to steal files, SMS messages, call records, and contact lists from the target device.
In short, these are fake, harmful apps that should be avoided at all costs. There is no reason to download an app relating to ChatGPT, until OpenAI themselves release such a thing — for which there are currently NO plans.
A suspicious ChatGPT Facebook page. Source: Tripwire
Researchers have also found multiple suspicious ChatGPT websites and pages, with fake URLs like “chat-gpt-pc[.]online”. These malicious websites offer a download of ChatGPT — despite it being solely browser-based. The intention is to infect your computer with malware: don’t let them.
Source:Twitter
Others are fake payment pages where you can supposedly upgrade to ChatGPT Plus, but will in fact lose your money and/or compromise your data.
Fake ChatGPT Plus payment page. Source: Cyble
As with the apps, stay away from these websites at all costs. Be sure to only use the official website from OpenAI: https://openai.com/blog/chatgpt.
Trend Micro Mobile Security will give you the defense you need against fake/malicious apps and phone malware. Download Trend Micro Mobile Security today — and guard against cyberthreats with:
Folder shields that protect your most sensitive date
We would also encourage readers to use our FREE Trend Micro Check tool and detect scams with ease: Trend Micro Check is an all-in-one browser extension and mobile app for detecting scams, phishing attacks, malware, and dangerous links.
After you’ve pinned the Trend Micro Check extension, it will block dangerous sites automatically! (Available on Safari, Google Chrome, and Microsoft Edge.)
You can also download the Trend Micro Check mobile app for 24/7 automatic scam and spam detection and filtering. (Available for Android and iOS).
We would encourage readers to head over to our new FREE ID Protection platform, which has been designed to meet challenges such as those above. With it, you can secure your social media accounts with our Social Media Account Monitoring tool, with which you’ll receive a personal report:
All this for free — give it a go today. As always, we hope this article has been an interesting and/or useful read. If so, please do SHARE it with family and friends to help keep the online community secure and informed — and consider leaving a like or comment below. Here’s to a secure 2023!
This article was published in collaboration with Trend Micro.
Image source: unsplash.com
