XWorm via ChatGPT malvertising

Summary

Seen from the middle of October 2024, with indicators dated the 19th. Outbrain recommendation panels on a large technology site carried a teaser promising more from ChatGPT; following it led to a site presenting itself as a prompt-writing service. The page ran a restyled build of the same public fake-CAPTCHA kit, this time framed as an invitation to join a community, with the clipboard trick sitting behind it. Running what had been copied invoked mshta against an obfuscated HTA file, which reached out for two further scripts: one loaded XWorm by way of RegAsm and started its hidden-desktop plugin, the other planted a registry autorun so the first came back at every boot. Proofpoint noted Russian comments in the site's script that a language model had probably written.

What changed since publication

The accounts above describe these indicators as they were on the day each was written. We re-check them ourselves and record every check, including the ones that find nothing — which is the only reason the gaps below can be stated rather than hidden.

Indicators checked

1 of 4

Checks recorded

2

Checks since publication

2

Never checked

3

Observation window 2026-08-10 to 2026-08-22. Checks are sampled, not continuous; the sampling policy is on /methodology. 3 indicators have never been checked by us at all.

Nothing has changed state between our first check and our most recent one. A domain that still resolves is not necessarily still serving anything — registrar hold pages answer DNS indefinitely, which is why the state above distinguishes “parked or suspended” from “resolving”.

Execution mechanisms

How the pasted command actually ran, as the published accounts describe it. Every row under “Mechanism” is one this campaign records; “Across the corpus” is the share of the 44 published campaigns in this corpus that record the same one — a baseline we can only state because we hold the whole set.

Both of these mechanisms appear together in 5 of the 44 campaigns on record, this one included. We record a mechanism only where a source describes one: an absent mechanism means nobody wrote it down, not that it did not happen.

Indicators

4 indicators, each present verbatim in at least one of the sources above. Values are shown defanged and are not links to the hosts — the link goes to our page for that indicator.

“Assessment” is who controls the host, not how dangerous it is. Many of these are compromised legitimate sites whose owners are victims, and they are excluded from every blocklist file we publish.