Find notable cyber news and cases, enriched with sources, timelines, and signals.
Home Watchlists Beta Browse News Feed Stats About Contact

Openew[.]app cloaked malware download portal

Malware Activity
First reported
Last updated
Happening score
H score 26
2 unique sources, 2 articles

Summary

Hide ▲

The openew[.]app malware-delivery activity now also uses legitimate ChatGPT shared pages as the first lure, with Google ads and SEO poisoning sending victims to a fake outage/download flow. Push Security said the page is hosted on a chatgpt.com/s/ URL, then redirects users to a cloaked phishing site that impersonates OpenAI's desktop application download portal and can deliver malware on macOS and Windows. The activity is described as InstallFix, a ClickFix variant, and the second-stage page uses conditional rendering to hide the malicious flow from scanners while real users see the download prompt.

Related Happenings

Bluekit adopts rrweb-based BitM session streaming for login theft

Technical Analysis
H score34 First: 25.06.2026 18:00 Last: 25.06.2026 18:00 Sources 1

About this happening: Bluekit has added browser-in-the-middle (BitM) login theft to its phishing stack, increasing the risk of session-token theft and account takeover. The mechanism us...

Open Happening

Browser-layer visibility guidance for browser-native threats

Defensive Guidance
H score22 First: 05.06.2026 17:00 Last: 05.06.2026 17:00 Sources 1

About this happening: Security teams are being pushed to treat browser sessions as the primary detection surface for phishing, credential theft, and ClickFix. Browser-native attac...

Open Happening

Google DoubleClick malspam campaign delivering DesckVB RAT

Campaign
H score33 First: 03.06.2026 19:29 Last: 03.06.2026 19:29 Sources 1

About this happening: A new malspam campaign is abusing Google's DoubleClick redirect path to evade detection and deliver DesckVB RAT, putting users and organizations at risk of malware inf...

Open Happening

ChatGPT and Claude phishing and malvertising campaign

Campaign
H score36 First: 01.06.2026 12:30 Last: 01.06.2026 12:30 Sources 1

How related: “The fact that both the ChatGPT and Claude variants are appearing in Push customer environments suggests a campaign – or at least a shared playbook – that is actively experimenting with different platforms and different social engineering approaches to find what converts best,” it explained.

About this happening: The ChatGPT- and Claude-themed phishing and malvertising campaign is actively steering users to fake download pages that can deliver malware. Attackers are using Goo...

Open Happening

LLMShare ChatGPT share-link malware lure campaign

Campaign
H score47 First: 29.05.2026 21:21 Last: 29.05.2026 21:21 Sources 1

How related: The "LLMShare" campaign, discovered by Push Security, uses Google ads to direct users searching for ChatGPT to a malicious shared ChatGPT page hosted on chatgpt.com, allowing the attack to be delivered through a legitimate OpenAI domain.

About this happening: The LLMShare campaign is using Google ads and a legitimate chatgpt.com shared page to route people searching for ChatGPT into a fake OpenAI outage lure that pu...

Open Happening

Timeline

  1. 29.05.2026 21:21 3 articles · 1mo ago

    Push Security finds ChatGPT share links used to deliver openew[.]app malware downloads

    Initial Disclosure

    Security researchers at Push Security identify the LLMShare campaign abusing ChatGPT content-sharing links and Google ads to send searchers to a fake OpenAI outage page rendered through a legitimate chatgpt.com/s/ URL. Visitors who click the download prompt are redirected to openew[.]app, a cloaked site that impersonates OpenAI's desktop application download portal and offers macOS and Windows malware downloads.

    Show sources
    Open in new tab