A convincing fake website is impersonating OpenAI’s ChatGPT download page and infecting visitors with malware designed to steal passwords, browser data, cryptocurrency wallets, and other sensitive information.
The site, openew[.]app, closely mimics OpenAI’s real ChatGPT download experience and offers what appear to be official desktop apps for both Windows and macOS. Instead, Windows users receive a credential-stealing malware loader, while Mac users get Odyssey Stealer, a fork of Atomic Stealer (AMOS), a well-known macOS malware family associated with cryptocurrency theft.
Read more…
Source: Malwarebytes Labs
Sign up for the Cyber Security Review Newsletter
The latest cyber security news and insights delivered right to your inbox
Related:
- Florida DMV hacked after police dept insecurely stored login info
October 19, 2026
The Florida Department of Highway Safety and Motor Vehicles (FLHSMV) has begun notifying victims impacted by a recent data breach of driver’s license and motor vehicle data, but not everyone whose information was stolen will receive an alert. In a notice posted Friday, FLHSMV confirmed that it took “immediate steps” after discovering that “a malicious actor ...
- Millions of California students’ sensitive data stolen in breach
October 19, 2026
Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service (ETS). ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department of Education (CDE). It has begun notifying students and families after an unauthorized ...
- Attack on BAE-managed system disrupts US bankruptcy courts
October 16, 2026
The US’ bankruptcy courts are currently down owing to what officials are calling a “cybersecurity incident.” The Administrative Office of the US Courts said the websites and systems that support the Bankruptcy Noticing Center (BNC), which manages electronic comms related to bankruptcy cases, were pulled offline while the vendor investigates. BAE Systems runs the affected systems and ...
- AI-Powered Espionage Campaign Targets Government Linux Infrastructure
October 15, 2026
Unit 42 identified a campaign targeting government entities and state-affiliated infrastructure, with observed activity spanning from October 2025–April 2026. We track this activity as CL-UNK-1211. In the operations we witnessed, the attackers relied on AI-generated payloads. Multiple artifacts deployed throughout the intrusion contained AI-made conversational annotations and developer reasoning comments, suggesting that the code was either ...
- Governments are hacking people with ‘zero-click’ spyware by showing them online ads
October 15, 2026
Security researchers at digital rights unit The Citizen Lab say government spyware makers are abusing global advertising networks to target and hack devices by serving malicious online adverts. A new report published Thursday by the University of Toronto lab, which investigates surveillance and digital rights abuses, said an Israeli company called Discover-Tech allows spyware makers to ...
- Unit 42 Uncovers PEERSTITCH, a Stealthy FortiGate Implant
October 14, 2026
Unit 42 investigated a multi-stage network intrusion against a telecommunications organization that occurred in September 2024, which we are tracking as cluster CL-STA-0954 (aka UNC5820). The attackers behind CL-STA-0954 achieved an initial compromise by exploiting CVE-2024-47575 against a centralized FortiManager appliance. From that single appliance, our observations are that the attackers exfiltrated an archive containing running ...