Security filters are trained to detect suspicious domains, shortened URLs and unknown senders. The LLMShare campaign, documented by Push Security on 29 May 2026, turns this logic on its head: the attack is served from chatgpt.com — one of the most recognised and trusted domains on the internet.
🔍 Suspicious message?
Analyze senders, links or files in real time with our scanner.
What is LLMShare
LLMShare is the name Push Security gave to an active campaign abusing the conversation-sharing feature of ChatGPT and Claude. Both platforms allow users to generate a public link to any conversation — a feature designed for sharing useful responses, but one that attackers have turned into a malware distribution vector.
The mechanism works as follows: the attacker creates a conversation in ChatGPT and uses its code-rendering feature to make the page display a completely fake service outage notice. The result is a convincing error page, hosted on a legitimate chatgpt.com/s/[id] URL, that the user sees exactly as they would any other OpenAI page.
How the victim reaches the fake page
Attackers do not wait for victims to stumble across the link. They purchase sponsored Google ads targeting searches such as "ChatGPT", "ChatGPT desktop app" or "ChatGPT download". When the user clicks the ad, they land on the fake shared page — with the chatgpt.com URL clearly visible in the browser bar.
The page displays the following message:
"We're experiencing high traffic right now. Our website is temporarily unavailable due to a large number of users. Download our desktop app to continue."
The download button does not lead to OpenAI. It leads to openew[.]app, a cloned site with official OpenAI branding, download buttons for macOS and Windows, and even a Chrome extension link. The downloaded file is an infostealer — malware designed to steal credentials, cookies and browser data.
Why security filters do not catch it
LLMShare's success rests on a single premise: the trust that security systems place in known domains. Email filters, antivirus tools and safe browsing features all maintain lists of trusted domains — and chatgpt.com appears on all of them.
When a security system analyses the link, it sees a legitimate OpenAI URL. There is no suspicious redirect, no recently registered domain, no self-signed certificate. Everything appears correct because technically it is — the page exists on OpenAI's own servers.
What the filter cannot see is the content the attacker has injected inside that shared page.
The Claude variant
The same technique has been detected on Claude, Anthropic's AI assistant. In this case, shared chats pose as Apple support walkthroughs containing malicious Terminal commands. The user believes they are following a legitimate tutorial while executing code designed to compromise their system.
What the downloaded malware steals
The file distributed in the LLMShare campaign is an infostealer — a category of malware specialised in exfiltrating data without the user noticing. Typical targets include passwords saved in the browser, active session cookies that allow account access without a password, autocomplete data such as credit cards and addresses, cryptocurrency wallets and credentials from installed applications.
Push Security confirmed the campaign was still generating active detections at the time their report was published.
Warning signs
No legitimate service interrupts its website and asks you to download a desktop app to keep using it. If you see a message like this on any page — even if the URL looks official — it is an immediate red flag.
Before downloading any application, verify you are on the manufacturer's official site. For ChatGPT, the official download is at openai.com, not any other domain. If you arrived at the page through a Google ad, close it and navigate directly by typing the URL into your browser.
The lesson of LLMShare
LLMShare represents an evolution in how attackers exploit digital trust. They no longer need to spoof a domain or fool filters with complex evasion techniques — they simply use the legitimate infrastructure of the most popular platforms of the moment.
Defence cannot rely solely on checking whether a domain is known. The relevant question is no longer "is this a trusted domain?" but "does what this page is asking me to do make sense?"
Forensic analysis: Oscar Orts · Judicial Computer Expert · ORTSLAB.ES
Sources: Push Security (May 2026) · BleepingComputer · Cybernews · The Decoder