Searching for 'ChatGPT download'? A fake site is handing out password-stealing malware

A convincing fake ChatGPT download page has been infecting people who go looking for the app. Malwarebytes flagged the campaign in late May: search for "ChatGPT download," click the wrong result or ad, and you land on a lookalike site (one was openew[.]app) that hands Windows users a password-stealing loader and Mac users the Odyssey infostealer.

It works because AI tools are new enough that most people don't know the official web address, so they trust whatever sits at the top of the search results. Scammers buy ads and build convincing clones to sit exactly there. Once the fake "installer" runs, it can lift your saved browser passwords, session cookies and crypto wallets in seconds.

The defence is a habit: don't install software from an ad or a random search result. Something web-based like ChatGPT barely needs a download at all - go straight to the official site by typing the address yourself. If you did run a suspect installer, change your important passwords from another device and switch on two-factor authentication.

If something did get onto your PC, Tendvane's Safety check looks exactly where these stealers hide - unsigned programs auto-starting from your AppData or Temp folders, and browser extensions you don't recognise - so you can spot and clear what's left behind.