LLMShare campaign exploits ChatGPT to deliver malware

The LLMShare campaign used paid Google Ads for ChatGPT-related queries to link to legitimate chatgpt.com shared conversation URLs that displayed fake outage pages and directed users to openew.app for malicious downloads; the distributed Windows and macOS installers were identified as infostealer malware (Odyssey Stealer). The report details cloaking/evasion measures that showed benign content to scanners, observed detections by vendors, and recommends Zero Trust controls (allowlisting, ringfencing, web content control, and privileged access management) to mitigate this delivery technique.