Global Surge in Malware Using Fake ChatGPT, Telegram Sites

Cybercriminals are increasingly exploiting trust in popular platforms by disguising sophisticated malware as legitimate applications, with recent campaigns targeting users via fake ChatGPT desktop apps and Telegram Premium websites. Microsoft has issued a critical warning about PipeMagic, a modular backdoor malware linked to the ransomware group Storm-2460, which exploits a Windows zero-day vulnerability to spy on users, steal sensitive data, and deploy ransomware across multiple regions including the U.S., Europe, and the Middle East. Meanwhile, Lumma Stealer malware is being distributed through fake Captcha prompts and deceptive Telegram Premium sites; this malware steals credentials, cryptocurrency wallet data, and other sensitive information, using advanced obfuscation techniques to evade detection. Security firms emphasize that these malware strains use sophisticated evasion tactics such as in-memory execution, encrypted communication channels, and masquerading as trusted system processes or legitimate services to avoid antivirus detection. Additionally, attackers are leveraging social engineering by creating highly convincing phishing pages and using communication channels like Telegram’s Bot API for real-time data exfiltration, further complicating defense efforts. Experts urge users to download software only from official sources, remain vigilant about suspicious prompts and websites, and employ technical safeguards alongside user awareness to mitigate risks.