How to Spot a ChatGPT Phishing Website

Hackers will always take advantage of the hot thing: COVID-19, crypto, tax season, or what have you. And with the rise of ChatGPT, they've not missed a beat.

Through the first four months of 2023, researchers from Check Point tracked 13,296 newly registered domains relating to Open AI and ChatGPT. According to new research from the company, one in 25 of those domains were malicious.

The fake sites tend to unsubtly project their relation to ChatGPT, with examples like:

Some of the fake sites take the obvious route, copying OpenAI's actual landing page as closely as possible:

Source: Check Point Research

Other lures take a different approach. Rather than impersonating OpenAI, they pretend to offer related services.

For example, the following landing page purports to offer software for detecting ChatGPT prose, something educators in particular have been calling out for in recent months:

Source: Check Point Research

Beyond the threat to individuals, "there are two main potential problems here for enterprises," notes Omer Dembinsky, data group manager at Check Point Software, and the lead researcher behind the report.

"One issue is that employees can download malicious files and applications from those websites, and thus provide cybercriminals with an initial foothold on their corporate network," he says. "The second issue is that the websites mimic ChatGPT so well that employees can potentially fall for their disguise and can submit queries with sensitive corporate information to those fake websites."

What to Do

To avoid falling for one of these traps, the researchers recommended attentiveness and basic cyber hygiene around phishing emails. Specifically:

However, the researchers caution that "while awareness of common phishing tactics and knowledge of anti-phishing best practices is important, modern phishing attacks are sophisticated enough that some will always slip through."

And so, Dembinsky says, enterprises need to both educate their workforce and implement effective anti-phishing mitigations.