Fake ChatGPT ads trick Windows users into downloading malware via ClickFix

Security researchers at Island found a malvertising campaign where sponsored Google ads lead to fake ChatGPT sites that push Windows users into ClickFix traps and malware downloads. Over May–August 2026 the campaign involved roughly 850 paid ads, 26 fake ChatGPT links and 71 Google Ads campaign IDs.

• About 850 paid ads and 26 fake ChatGPT links over three months
• ClickFix trap makes Windows run a command that downloads malware
• Malware uses NetSupport RAT and a Telegram bot to exfiltrate data
• Infection survives reboots; number of affected users remains unknown