答案已發布3 天前Last edited 3 天前34 來源

LLMShare 攻擊行動：黑客點樣利用 ChatGPT 分享功能變成惡意軟件散播網絡

由 Push Security 喺 2026 年 5 月發現嘅 LLMShare 行動，利用 Google 廣告將受害者引導到一個存放喺合法 chatgpt.com 分享連結上嘅偽冒 OpenAI 故障通知頁面。呢種攻擊利用咗一種「信任代理」漏洞，惡意內容繼承咗 OpenAI 域名嘅信譽，令用戶同基於網址嘅安全過濾器好難喺惡意軟件下載之前察覺到威脅。

使用 Studio Global AI 搜尋並查核事實瀏覽更多熱門頁面

169K0

Illustration of a malicious threat actor weaponizing ChatGPT's share feature with a fake outage page and credential-stealing malware targeting Windows and macOS users — What is the "LLMShare" campaign disclosed by Push Security, in which threat actors exploit ChatGPT's share feature and HTML rendering to hosThe LLMShare campaign exploits trusted AI platform URLs to deliver malware. Image: AI-generated.
AI 提示
Create a landscape editorial hero image for this Studio Global article: What is the "LLMShare" campaign disclosed by Push Security, in which threat actors exploit ChatGPT's share feature and HTML rendering to hos. Article summary: ## The LLMShare Campaign. Topic tags: general, academic, general web. Reference image context from search candidates: Reference image 1: visual subject "Threat actors are targeting LLMs in a widespread reconnaissance campaign that could be the first step in cyberattacks on exposed AI models." source context "Attackers Targeting LLMs In Widespread Campaign" Reference image 2: visual subject "Threat actors are targeting LLMs in a widespread reconnaissance campaign that could be the first step in cyberattacks on exposed AI models." source context "Attackers Targeting LLMs In Widespread Campaign" Style: premium digital editorial illustration, source-backed research
openai.com

一個手法精密嘅惡意軟件行動，將 ChatGPT 其中一個最實用嘅功能——公開分享對話——變成強大嘅釣魚攻擊武器。網絡安全公司 Push Security 發現嘅「LLMShare」行動，展示咗威脅行為者點樣由粗糙嘅釣魚電郵進化到利用大型 AI 平台嘅可信基礎設施。

攻擊者唔係傳送可疑嘅連結，而係購買 Google 搜尋廣告。當用戶搜尋「ChatGPT」時，呢啲廣告就會出現。廣告會連結到一個睇落似 OpenAI 官方頁面、網址開頭係 chatgpt.com/share/ 嘅頁面。但呢個分享嘅對話內容並唔係聊天記錄，而係一個整到好似真嘅服務故障通知，話俾用戶知需要下載「桌面版應用程式更新」先可以恢復服務。下載連結指向攻擊者控制嘅網域 openew[.]app，下載嘅係竊取憑證嘅惡意軟件。

呢次攻擊喺唔同平台上嘅手法都非常精準。Windows 用戶會收到專門設計嚟收集瀏覽器密碼、Cookies 同其他敏感憑證嘅惡意軟件。macOS 用戶就會中 Odyssey Stealer，呢款資訊竊取軟件由惡名昭彰嘅 Atomic Stealer (AMOS) 家族演變而嚟。Odyssey 以「惡意軟件即服務」（MaaS）平台模式運作，專門竊取加密貨幣錢包資料、瀏覽器憑證同系統資訊，某啲變種更加有持續機制，可以喺系統重新開機後繼續存活。

Studio Global AI

Search, cite, and publish your own answer

Use this topic as a starting point for a fresh source-backed answer, then compare citations before you share it.

使用 Studio Global AI 搜尋並查核事實

人們還問