On 2026-05-28 Malwarebytes researcher Stefan Dasic disclosed an active dual-platform malware delivery campaign using the typosquat domain openew[.]app, a brand-impersonation page styled after the legitimate ChatGPT download landing page. The site performs server-side or client-side OS fingerprinting and serves a Windows Chat_GPT.exe to Windows visitors and a macOS ChatGpt.dmg to macOS visitors. Both payloads ultimately exist to steal credentials, browser data, and cryptocurrency wallet contents, with the macOS variant going further by replacing genuine Ledger and Trezor desktop apps with trojanized builds to capture seed phrases and recovery material going forward.

WINDOWS CHAIN (Chat_GPT.exe → EApp.exe → PowerShell stdin loader): The Windows payload Chat_GPT.exe (SHA-256 c9e0e6985dca3a179c9bdea4e7b38f7dc57fe00ecedc2fd634256fc53bf2de2d) is an Inno Setup installer — a legitimate free installer toolkit widely used by software vendors, here repurposed to lower static detection. The installer extracts an Electron application skeleton into %APPDATA%\LeronApplication, including a renamed Electron host EApp.exe and supporting Node.js / V8 resources. EApp.exe is run after install. Rather than carrying malicious payload bytes on disk, EApp.exe spawns PowerShell with the command line ''powershell.exe -ExecutionPolicy Unrestricted -Command -''. The trailing single ''-'' to -Command instructs PowerShell to read the script body from standard input. EApp.exe writes the actual malicious PowerShell code into that stdin handle, so the malicious script never touches disk in a form that AV file scanners or EDR file-write hooks can trivially inspect. This is a fileless / living-off-the-land delivery pattern that defeats most signature-based AV: at the time of Malwarebytes analysis only 9 of 69 antivirus engines on a public multiscanner detected Chat_GPT.exe. The PowerShell stage performs command-and-control over HTTP to 188.137.246.189 using a /laravel.php endpoint with query parameters api=api, hash={value}, and message={value} — a hand-rolled PHP-handler C2 design typical of low-tier commodity stealers and dropper services rather than off-the-shelf C2 frameworks (BeaconBeagle lookups against 188.137.246.189 and openew.app returned no Cobalt Strike / Sliver / Mythic / Brute Ratel beacon or config matches as of 2026-05-28). Additional infrastructure observed in the campaign includes 192.253.248.181 and 172.94.9.250. Persistence on Windows is established via standard Run-key / Startup-folder mechanisms typical of the Electron-skeleton loader pattern.

MACOS CHAIN (ChatGpt.dmg → Atomic Stealer AppleScript chain → wallet trojanization): The macOS payload ChatGpt.dmg (SHA-256 c0919e1999eaee67e67aeda0287722775afb04e9a9a0f727928b4d11265fb70b) drops Atomic Stealer (AMOS), an established macOS infostealer-as-a-service tracked since April 2023. Pricing has reportedly settled around $3,000/month in cryptocurrency, indicating a financially motivated operator with the budget to subscribe to a polished MaaS rather than build from scratch. AMOS is implemented primarily as a long AppleScript chain executed by osascript, a pattern that lets the malware abuse OS-level scripting privileges to drive the GUI, query system directories, and orchestrate sudo. The execution sequence is: (1) silent password validation using ''dscl . -authonly $USER $candidate'' against any password the user has already typed elsewhere in the session or any default candidates; (2) if no valid password is on hand, display a native-styled dialog prompt reading ''Please enter device password to continue'' — visually indistinguishable from a legitimate macOS authentication prompt; (3) revalidate the typed password with dscl until a correct one is captured (T1056.002 GUI Input Capture combined with T1078 Valid Accounts); (4) copy the user keychain (login.keychain-db) and any iCloud Keychain data accessible via security CLI, exfiltrating cleartext via the captured password (T1555.001); (5) iterate 12 Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Arc, Yandex, etc.) plus Firefox and Waterfox, copying Cookies, Login Data, autofill, and credit-card stores (T1555.003, T1539); (6) copy Telegram tdata / session files (T1539 session hijack); (7) enumerate 16 cryptocurrency wallet directories — Ledger Live, Trezor Suite, Exodus, Electrum, Sparrow, MyMonero, Coinomi, Atomic, Wasabi, Guarda, Jaxx Liberty, Binance, BitPay, Trust, Mycelium, Argent — and recursively scan ~/Desktop and ~/Documents for files matching .wallet, .seed, .key, and .kdbx extensions (T1083, T1005); (8) trojanize Ledger Live, Ledger Wallet, and Trezor Suite by removing the legitimate /Applications/ bundle (using sudo rm -rf with the captured password where possible, falling back to a non-privileged rm -rf of any user-writable copies) and substituting a backdoored build supplied by the operator (T1554 Compromise Host Software Binary). The trojanized wallet apps are the long-tail payoff: they sit on the victim machine forever capturing seed phrases, PINs, and transaction approvals every time the victim opens what they think is their hardware-wallet companion app. (9) Compress harvested data and exfiltrate to a hardcoded operator server.

DISTRIBUTION: No specific traffic-source telemetry was published in the disclosure, but the surrounding signal — typosquat .app TLD (the .app TLD forces HTTPS at the registry level, giving a green padlock that consumers read as trust), brand impersonation of ChatGPT, dual-platform fingerprinting, and AMOS payload — fits the documented in-the-wild distribution pattern for the AMOS ecosystem: paid search ads against ''ChatGPT download'' / ''download chatgpt mac'' queries, SEO-poisoned YouTube video descriptions, fake review/comparison blog posts, and links posted into AI-focused Discord and Telegram communities. The operator targets the rapidly growing search surface for ''ChatGPT download'' from non-technical consumers and developers who don''t know that ChatGPT is delivered via OpenAI''s own openai.com / chat.openai.com / chatgpt.com domains.

RELATIONSHIP TO PRIOR THREATS: Distinct from prior AMOS ClickFix variants (TL-2026-0336, TL-2026-0471) which used fake CAPTCHA / ''verify you are human'' lure pages, and distinct from the OpenClaw skill supply-chain compromise (TL-2026-0136). This entry tracks the openew[.]app fake-download infrastructure specifically; the AMOS payload itself is a recurring family.

IMPACT: Full credential compromise of any account password stored in macOS keychain (often hundreds), cleartext extraction of all saved browser credentials and session cookies (enabling MFA-bypass session-replay attacks against email, GitHub, AWS, banking), and — uniquely impactful — persistent compromise of cryptocurrency hardware wallets via trojanized companion-app replacement. On Windows the immediate impact is data theft via fileless PowerShell C2, with persistent foothold for follow-on payload delivery.