GoKawiilFake sponsored Google ads lead ChatGPT users to malware via custom GPT
Researchers have identified a scam that begins with a sponsored Google ad for ChatGPT, which directs users to a custom GPT hosted on OpenAI's real domain. That custom GPT displays a fake 'Service Availability Notice' urging users to either upgrade to Plus or click a 'backup domain' link, the latter of which leads to malware installation. Because the page sits on the genuine chat.openai.com domain and shows the user's logged-in account, the only visible red flag is an unfamiliar model name like 'Plus 5.6.'