This new ChatGPT scam tricks you into installing malware – how to spot the trap

ZDNET Key Takeaways

• There is a new scam involving ChatGPT.
• The scam starts with a sponsored Google link.
• The link leads to a custom GPT which gives malicious information.

A new scam involving ChatGPT has emerged that could trick you into installing malware on your computer if you’re not careful.

Over the past few days, there have been reports of users experiencing strange interaction while using ChatGPT. “Notice of service availability,” the message reads. “We are currently experiencing limited availability on the primary domain. Please choose one of the following options to continue:”

Also: This new cyberattack is tempting you to hack yourself. Here’s how to spot it

The chat presents an offer to upgrade to a Plus subscription or a link to a backup domain. Here’s how the scam works, why it’s so convincing, and what you can do to avoid it.

(Disclosure: Ziff Davis, the parent company of ZDNET, filed a lawsuit in April 2025 against OpenAI, alleging that it had violated Ziff Davis’ copyrights in the training and operation of its AI systems.)

Artie Beaty/ZDNET

The Custom GPT Scam

The scam starts when you search for “ChatGPT” in Google. Like almost all Google searches, you will see sponsored results, or paid ads, above the genuine search results. If you click on what appears to be a real link to ChatGPT, you are redirected to what appears to be the real site.

Instead, you landed on a custom GPT or a specialized user-generated version of ChatGPT tailored to specific tasks. In this case, the task is to spit out the response to the availability notice, regardless of what is entered.

What’s most compelling is that you’re on the actual ChatGPT domain and your account is logged in (if you were before). At first glance, there’s nothing to indicate that it’s not genuine, other than the name “Plus 5.6”. If you’re not familiar with ChatGPT template naming conventions, this won’t stand out.

Also: I’m a tech pro and an AI job scam almost cheated me

If you click the link in the answer (this is a free site hosted on Google Sites and obviously not a ChatGPT domain), you are presented with a fake Cloudflare verification and instructions for pasting and running a command in Windows/PowerShell. Running this command installs malware on your computer.

I tried the process myself and clicked on the first result after a simple search for ChatGPT. I landed on one of the scams. No matter what I typed, I got the same “limited” response with a link. My editor here at ZDNET tried the same process and got the ChatGPT normal, so it doesn’t appear these are all sponsored results.

Google told me that it had disabled several accounts associated with the specific ad campaign I saw, but that, of course, doesn’t mean this issue won’t reappear, so it’s good to be aware of it.

How to stay safe

Here’s how to avoid this specific scam, as well as some general tips for staying safe online.

• Type chatgpt.com directly into your browser instead of searching for it.
• Avoid clicking (or at least being wary of) sponsored links in Google. These ads have always been malicious, so much so that Google even deployed Gemini to detect and block bad ads.
• Never paste or run a command on your computer if you are unsure of what it will do, especially if a link or pop-up window asks you to do so.

Roman Oliinyk, CEO and founder of PayCore Media Inc, a network security specialist who spent 10 years building data leak protection systems for major U.S. companies, noted that a real Cloudflare check would never ask you to do anything on your keyboard. “At most,” he says, “it asks you to check a box or press a button. »

Also: This simple ChatGPT tip helps you spot scams before you click or respond.

Oliinyk also recommended treating sponsored results like ads (which they are) and treating a link from a chatbot like you would a link from a stranger.

I have contacted Google and OpenAI for comment. OpenAI has not yet responded, but a Google spokesperson told me: “Malicious advertising has no place on Google. We have suspended several advertiser accounts to block this campaign and we are continually updating our defenses to stop new threats.”

Artie Beaty

Contributing writer

Artie Beaty is a freelance writer, based just outside of Charlotte, with a passion for smart home technology and tech news. He holds a bachelor’s degree in journalism from UNC Charlotte and has been writing for over 15 years. On weekends, you’ll find him leading haunted ghost tours in uptown Charlotte.

See full bio