Hackers are weaponizing fake ChatGPT apps to steal your passwords

If you've been looking for a handy Windows app or an Android download for ChatGPT, you might want to hit pause.

OpenAI doesn't have an official desktop app. But hackers are more than happy to pretend they do.

Security researchers have uncovered hundreds of newly registered domains piggybacking on the ChatGPT name. With the chatbot becoming the fastest-growing app in internet history, scammers are now aggressively weaponizing that hype to distribute infostealers and siphon personal data.

Fake desktop apps packing real malware

Security researcher Dominic Alvieri recently flagged several fraudulent websites posing as official ChatGPT portals, as first reported by Bleeping Computer.

One site, operating under the domain chat-gpt-pc.online, promised visitors a downloadable local Windows version of ChatGPT. Instead of an AI assistant, victims got infected with the RedLine infostealer. RedLine essentially targets stored credentials across your system, extracting saved passwords, auto-fill data, and credit card numbers right out of browsers like Google Chrome.

Alvieri also spotted counterfeit ChatGPT apps slipping into the Google Play Store, running similar credential-harvesting phishing operations on mobile devices.

A separate report from cybersecurity firm Cyble revealed just how widespread the campaign has become, tallying over 50 fake ChatGPT apps in the wild. Some take an even more direct route to monetization: one fake app called chatGPT1 offers zero AI functionality at all, secretly enrolling users into expensive SMS billing subscriptions behind their backs.

OpenAI's tool remains accessible only via web browsers, specifically at chat.openai.com or its recently acquired AI.com.

Why it matters

For everyday users, the takeaway is simple: do not download any standalone ChatGPT software. OpenAI just launched a $20-per-month subscription, which naturally creates a massive pool of users hunting for free desktop workarounds or localized installers. That curiosity is exactly what hackers are monetizing.

In our view, this highlights a familiar, ugly playbook. Scammers didn't invent new zero-days here; they just slapped the hottest tech buzzword onto ancient threats like the RedLine trojan and legacy carrier-billing fraud. The sheer speed at which fake apps infiltrated official hubs like the Google Play Store shows that platform moderation is already lagging behind the generative AI wave.