4M Accounts Compromised in #LilyCollinsHack: Fake ChatGPT Apps & Websites Alert

ChatGPT is everywhere in the news lately, understandably as its ingenious uses appear limitless. In our previous two articles, we covered the what and how, and also the effects of ChatGPT on children and education.  

Unfortunately however, it’s not all positives: the chatbot can also be used to write malicious coding and create viruses, while researchers have also warned that cybercriminals can use ChatGPT to compose the text for phishing emails at a fraction of the cost — meaning more phishing emails and more cyber threats. Then there’s the problem of fake ChatGPT apps and websites.  

#LilyCollinsHack: accounts compromised by fake ChatGPT apps

Have you seen people using the hashtag #LilyCollinsHack on social media recently? Its widespread sharing stems from Facebook users having their accounts hacked, and their names/profile pictures changed to resemble actress Lily Collins’s account. Reports state that over 4 million accounts have been affected – the number is so high because the attack commenced after victims were duped into downloading fake ChatGPT apps that were disguised as Chrome extensions.

Using fake ChatGPT apps in order to steal personal credentials is a known recent tactic used by hackers and cybercriminals, and this latest event is just the tip of the iceberg.

Victims discussing #LilyCollinsHack on Reddit.

Fake ChatGPT Apps 

In our investigations, we have found that there is a proliferation of fake ChatGPT apps. It is important to note that there is currently NO official ChatGPT app, neither is there a download — it is ONLY available on the official webpage. 

We have tracked various suspicious ChatGPT apps, some being malicious Trojan viruses and others PUAs (“potentially unwanted app”). PUAs are not considered malware, but still pose a lower security and privacy risk: they result in your device’s operating system slowing down, or in the appearance of unexpected and intrusive ads.  

Trojan apps have the capacity to install malicious software onto your device, and even to encrypt your data/device. A trojan is a nasty malware type that can put users, user data, or devices, at high risk of serious damage. The ChatGPT trojan apps we have discovered are in fact not new — but merely under a new disguise. Previously, they were listed as YouTube and Netflix “premium” apps (also fake).   

The “ChatGPT” trojan app discreetly subscribes its target to various premium services through SMS billing fraud. While the “AI photo” trojan app belongs to the Spynote malware, which can be used to steal files, SMS messages, call records, and contact lists from the target device. 

In short, these are fake, harmful apps that should be avoided at all costs. There is no reason to download an app relating to ChatGPT, until OpenAI themselves release such a thing — for which there are currently NO plans.  

Fake ChatGPT Websites 

A suspicious ChatGPT Facebook page. Source: Tripwire

Researchers have also found multiple suspicious ChatGPT websites and pages, with fake URLs like “chat-gpt-pc[.]online”. These malicious websites offer a download of ChatGPT — despite it being solely browser-based. The intention is to infect your computer with malware: don’t let them.  

Source:Twitter

Others are fake payment pages where you can supposedly upgrade to ChatGPT Plus, but will in fact lose your money and/or compromise your data.   

Fake ChatGPT Plus payment page. Source: Cyble

As with the apps, stay away from these websites at all costs. Be sure to only use the official website from OpenAI: https://openai.com/blog/chatgpt.   

Protect Yourself from Fakes 

Trend Micro Mobile Security will give you the defense you need against fake/malicious apps and phone malware. Download Trend Micro Mobile Security today — and guard against cyberthreats with:  

• Real-time Web Threat Protection 
• Cloud-based AI, Smart Protection Network™, which keeps track of evolving threats 
• Trend Micro Pay Guard, which opens payment windows 
• Anti-phishing/spam software  

Folder shields that protect your most sensitive date 
 
We would also encourage readers to use our FREE Trend Micro Check tool and detect scams with ease: Trend Micro Check is an all-in-one browser extension and mobile app for detecting scams, phishing attacks, malware, and dangerous links. 

Protecting Your Social Media and Personal Info

We would encourage readers to head over to our new FREE ID Protection platform, which has been designed to meet challenges such as those above. With it, you can secure your social media accounts with our Social Media Account Monitoring tool, with which you’ll receive a personal report:

Aside from this, you can also:

• Check to see if your data (email, number, password, social media) has been exposed in a leak,
• Receive the strongest tough-to-hack password suggestions from our advanced AI.

All this for free — give it a go today. As always, we hope this article has been an interesting and/or useful read. If so, please do SHARE it with family and friends to help keep the online community secure and informed — and consider leaving a like or comment below. Here’s to a secure 2023!

This article was published in collaboration with Trend Micro.

Image source: unsplash.com