Attackers poisoned public ChatGPT and Grok conversations so they appeared in search results as fake troubleshooting help. Huntress says searches such as "clear disk space on macOS" surfaced shared conversations on chatgpt.com and grok.com that gave ClickFix-style instructions—steps that trick users into running malicious commands themselves—instead of legitimate advice.
Why it matters: People increasingly trust AI-hosted answers, and these lures can appear on real OpenAI and xAI domains in normal search results. Users should treat shared AI conversations like untrusted web content, and defenders should warn staff not to run shell commands copied from AI troubleshooting pages without verification.
Sponsored by Huntress Labs
2026.09.11
100% relevant
This article establishes a specific new abuse pattern—search-indexed ChatGPT and Grok share pages used as ClickFix malware lures—that is not the same underlying event as the tracked OpenAI fake outage-page campaign.
← Back to all stories