The abuse of ChatGPT share links to host fake outage pages is a reminder that attackers will exploit user trust in legitimate platforms, not just fake domains. According to the report, threat actors are using ChatGPT’s content-sharing feature to display fake OpenAI outage pages that push users to download malware disguised as the ChatGPT desktop application.

This is especially dangerous because the lure appears under a legitimate OpenAI domain, which can make users lower their guard. The page claims ChatGPT is experiencing an outage and offers a “desktop app” as a workaround. That is social engineering with borrowed trust: make the page look official, create urgency, and give the victim a fake solution. Naturally, even outage anxiety has now been monetized by malware operators. 

Users should remember that outages do not require downloading emergency desktop apps from shared pages. ChatGPT status should be verified only through official OpenAI channels, and software should be downloaded only from the official app stores or trusted OpenAI download pages. Any page that asks users to install a file because an online service is unavailable should be treated with suspicion. 

Organizations should also monitor for fake AI tool downloads, suspicious OpenAI-themed domains or shared links, unexpected installers, and malware delivered through trusted collaboration or sharing platforms. DNS filtering, web protection, endpoint detection, and user awareness are important because attackers increasingly hide malicious content behind legitimate services. 

The broader lesson is simple: trusted platforms can still be abused to host untrusted content. A familiar domain is not enough. Users and security tools must evaluate the behavior, message, download request, and destination. If a shared page tells users to install software during an outage, the safest response is not to click faster. It is to stop and verify.

Threat actors are abusing ChatGPT's content-sharing feature to display fake OpenAI outage pages that direct users to download malware disguised as the ChatGPT desktop application. [...]

Source: ChatGPT share links abused to host fake outage pages to deliver malware via Bleeping Computer — published 29 May 2026.