Users warned of fake ChatGPT ‘Plus 5.6’ Malware scam

According to cybersecurity researchers, the scam can begin when a user searches for ChatGPT on Google and clicks a sponsored result.

The link may lead to the legitimate ChatGPT website, but attackers have created a fake Custom GPT called “Plus 5.6” to make the scheme appear genuine.

The fake GPT displays a message claiming that the main service has limited availability and directs users to a supposed “backup domain” for continued access.

The use of the name “Plus 5.6” is designed to make the fraudulent service look like an official ChatGPT upgrade or new model.

The most dangerous part comes when users follow the link to the alleged backup site.

Researchers found that the page can display a fake Cloudflare verification screen and instruct visitors to copy and run a command on their computers.

This is a known ClickFix technique used to trick users into installing malware themselves.

Security researchers said the campaign has been linked to malware capable of giving attackers remote access to infected computers and potentially exposing files and other sensitive information.

Huntress reported at least 40 incidents connected to the malicious Google Sites page.

Experts have urged users not to trust sponsored search results blindly and to be especially careful with unexpected upgrade messages, unfamiliar domains and fake verification pages.

Users should access ChatGPT through its official website, carefully check web addresses and never copy or run commands suggested by an unfamiliar webpage or fake CAPTCHA.

OpenAI lists its official website and support channels on its Help Center.