#malvertising

2 articles

The malicious GPT sat on chatgpt.com, the ad was bought on Google, and the victim pasted the command themselves

2026-10-01AI

Huntress traced a remote access trojan back to a Custom GPT called Plus 5.6, hosted on OpenAI's own domain and reached through a sponsored Google result for the word chatgpt. The page it sent people to imitated a Cloudflare check and asked them to paste a line into PowerShell. OpenAI removed the GPT on 25 September; a replacement appeared on the 27th.

Nothing in Google's authentication was bypassed. The malware took the session and replayed it

2026-09-08Security

JSCeal steals cookies from Chromium browser profiles and reconstructs the session to reach a victim's Google account. That is being written up as bypassing Google authentication. It is not — no authentication mechanism is defeated, and the difference decides whether you go looking for an auth fix that does not exist.