# Fake ChatGPT Download Site openew[.]app — Dual-Platform Delivery: Windows Electron/Inno Setup PowerShell-stdin Loader & macOS Atomic Stealer (AMOS) With Ledger/Trezor Wallet Replacement

> A typosquat impersonation site at openew[.]app, mimicking the OpenAI ChatGPT download page, fingerprints visitor OS and serves architecture-specific malware. Windows visitors receive Chat_GPT.exe — an Inno Setup installer that drops an Electron skeleton (EApp.exe) under %APPDATA%\LeronApplication and spawns PowerShell with -ExecutionPolicy Unrestricted -Command - to execute commands read from stdin (fileless), beaconing to 188.137.246.189 via /laravel.php?api=api&hash=...&message=... endpoints. macOS visitors receive ChatGpt.dmg containing Atomic Stealer (AMOS), which runs a long AppleScript chain: silent dscl-based password validation, a fake ''Please enter device password to continue'' prompt, keychain copy, theft from 12 Chromium browsers plus Firefox/Waterfox (cookies, logins), Telegram session theft, enumeration of 16 cryptocurrency wallet directories (Ledger Live, Trezor Suite, Exodus, Electrum, Sparrow, etc.), recursive harvest of .wallet/.seed/.key/.kdbx files from Desktop/Documents, and trojanized in-place replacement of Ledger Live, Ledger Wallet, and Trezor Suite via sudo (using captured credentials) or rm -rf fallback. Distribution is consistent with search-ad poisoning, SEO poisoning, YouTube spam, and AI-focused Discord/Telegram lure communities.

- **Published:** 2026-05-28T00:00:00Z
- **Last reviewed:** 2026-05-28T00:00:00Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-0614
- **ID:** TL-2026-0614
- **Severity:** HIGH
- **Category:** MALWARE
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)

## Description

On 2026-05-28 Malwarebytes researcher Stefan Dasic disclosed an active dual-platform malware delivery campaign using the typosquat domain openew[.]app, a brand-impersonation page styled after the legitimate ChatGPT download landing page. The site performs server-side or client-side OS fingerprinting and serves a Windows Chat_GPT.exe to Windows visitors and a macOS ChatGpt.dmg to macOS visitors. Both payloads ultimately exist to steal credentials, browser data, and cryptocurrency wallet contents, with the macOS variant going further by replacing genuine Ledger and Trezor desktop apps with trojanized builds to capture seed phrases and recovery material going forward.

WINDOWS CHAIN (Chat_GPT.exe → EApp.exe → PowerShell stdin loader):
The Windows payload Chat_GPT.exe (SHA-256 c9e0e6985dca3a179c9bdea4e7b38f7dc57fe00ecedc2fd634256fc53bf2de2d) is an Inno Setup installer — a legitimate free installer toolkit widely used by software vendors, here repurposed to lower static detection. The installer extracts an Electron application skeleton into %APPDATA%\LeronApplication, including a renamed Electron host EApp.exe and supporting Node.js / V8 resources. EApp.exe is run after install. Rather than carrying malicious payload bytes on disk, EApp.exe spawns PowerShell with the command line ''powershell.exe -ExecutionPolicy Unrestricted -Command -''. The trailing single ''-'' to -Command instructs PowerShell to read the script body from standard input. EApp.exe writes the actual malicious PowerShell code into that stdin handle, so the malicious script never touches disk in a form that AV file scanners or EDR file-write hooks can trivially inspect. This is a fileless / living-off-the-land delivery pattern that defeats most signature-based AV: at the time of Malwarebytes analysis only 9 of 69 antivirus engines on a public multiscanner detected Chat_GPT.exe. The PowerShell stage performs command-and-control over HTTP to 188.137.246.189 using a /laravel.php endpoint with query parameters api=api, hash={value}, and message={value} — a hand-rolled PHP-handler C2 design typical of low-tier commodity stealers and dropper services rather than off-the-shelf C2 frameworks (BeaconBeagle lookups against 188.137.246.189 and openew.app returned no Cobalt Strike / Sliver / Mythic / Brute Ratel beacon or config matches as of 2026-05-28). Additional infrastructure observed in the campaign includes 192.253.248.181 and 172.94.9.250. Persistence on Windows is established via standard Run-key / Startup-folder mechanisms typical of the Electron-skeleton loader pattern.

MACOS CHAIN (ChatGpt.dmg → Atomic Stealer AppleScript chain → wallet trojanization):
The macOS payload ChatGpt.dmg (SHA-256 c0919e1999eaee67e67aeda0287722775afb04e9a9a0f727928b4d11265fb70b) drops Atomic Stealer (AMOS), an established macOS infostealer-as-a-service tracked since April 2023. Pricing has reportedly settled around $3,000/month in cryptocurrency, indicating a financially motivated operator with the budget to subscribe to a polished MaaS rather than build from scratch. AMOS is implemented primarily as a long AppleScript chain executed by osascript, a pattern that lets the malware abuse OS-level scripting privileges to drive the GUI, query system directories, and orchestrate sudo. The execution sequence is: (1) silent password validation using ''dscl . -authonly $USER $candidate'' against any password the user has already typed elsewhere in the session or any default candidates; (2) if no valid password is on hand, display a native-styled dialog prompt reading ''Please enter device password to continue'' — visually indistinguishable from a legitimate macOS authentication prompt; (3) revalidate the typed password with dscl until a correct one is captured (T1056.002 GUI Input Capture combined with T1078 Valid Accounts); (4) copy the user keychain (login.keychain-db) and any iCloud Keychain data accessible via security CLI, exfiltrating cleartext via the captured password (T1555.001); (5) iterate 12 Chromium-based browsers (Chrome, Edge, Brave, Opera, Vivaldi, Arc, Yandex, etc.) plus Firefox and Waterfox, copying Cookies, Login Data, autofill, and credit-card stores (T1555.003, T1539); (6) copy Telegram tdata / session files (T1539 session hijack); (7) enumerate 16 cryptocurrency wallet directories — Ledger Live, Trezor Suite, Exodus, Electrum, Sparrow, MyMonero, Coinomi, Atomic, Wasabi, Guarda, Jaxx Liberty, Binance, BitPay, Trust, Mycelium, Argent — and recursively scan ~/Desktop and ~/Documents for files matching .wallet, .seed, .key, and .kdbx extensions (T1083, T1005); (8) trojanize Ledger Live, Ledger Wallet, and Trezor Suite by removing the legitimate /Applications/ bundle (using sudo rm -rf with the captured password where possible, falling back to a non-privileged rm -rf of any user-writable copies) and substituting a backdoored build supplied by the operator (T1554 Compromise Host Software Binary). The trojanized wallet apps are the long-tail payoff: they sit on the victim machine forever capturing seed phrases, PINs, and transaction approvals every time the victim opens what they think is their hardware-wallet companion app. (9) Compress harvested data and exfiltrate to a hardcoded operator server.

DISTRIBUTION:
No specific traffic-source telemetry was published in the disclosure, but the surrounding signal — typosquat .app TLD (the .app TLD forces HTTPS at the registry level, giving a green padlock that consumers read as trust), brand impersonation of ChatGPT, dual-platform fingerprinting, and AMOS payload — fits the documented in-the-wild distribution pattern for the AMOS ecosystem: paid search ads against ''ChatGPT download'' / ''download chatgpt mac'' queries, SEO-poisoned YouTube video descriptions, fake review/comparison blog posts, and links posted into AI-focused Discord and Telegram communities. The operator targets the rapidly growing search surface for ''ChatGPT download'' from non-technical consumers and developers who don''t know that ChatGPT is delivered via OpenAI''s own openai.com / chat.openai.com / chatgpt.com domains.

RELATIONSHIP TO PRIOR THREATS:
Distinct from prior AMOS ClickFix variants (TL-2026-0336, TL-2026-0471) which used fake CAPTCHA / ''verify you are human'' lure pages, and distinct from the OpenClaw skill supply-chain compromise (TL-2026-0136). This entry tracks the openew[.]app fake-download infrastructure specifically; the AMOS payload itself is a recurring family.

IMPACT:
Full credential compromise of any account password stored in macOS keychain (often hundreds), cleartext extraction of all saved browser credentials and session cookies (enabling MFA-bypass session-replay attacks against email, GitHub, AWS, banking), and — uniquely impactful — persistent compromise of cryptocurrency hardware wallets via trojanized companion-app replacement. On Windows the immediate impact is data theft via fileless PowerShell C2, with persistent foothold for follow-on payload delivery.

## MITRE ATT&CK

- T1583 Acquire Infrastructure
- T1608 Stage Capabilities
- T1588 Obtain Capabilities
- T1189 Drive-by Compromise
- T1204 User Execution
- T1059 Command and Scripting Interpreter
- T1547 Boot or Logon Autostart Execution
- T1548 Abuse Elevation Control Mechanism
- T1036 Masquerading
- T1140 Deobfuscate/Decode Files or Information
- T1027 Obfuscated Files or Information
- T1685 Disable or Modify Tools
- T1555 Credentials from Password Stores
- T1056 Input Capture
- T1539 Steal Web Session Cookie
- T1552 Unsecured Credentials
- T1083 File and Directory Discovery
- T1217 Browser Information Discovery
- T1082 System Information Discovery
- T1005 Data from Local System
- T1560 Archive Collected Data
- T1554 Compromise Host Software Binary
- T1071 Application Layer Protocol
- T1041 Exfiltration Over C2 Channel
- T1567 Exfiltration Over Web Service
- T1657 Financial Theft

## Sources

- [Fake ChatGPT download site infects Windows and Mac users with malware](https://www.malwarebytes.com/blog/threat-intel/2026/05/fake-chatgpt-download-site-infects-windows-and-mac-users-with-malware)
- [MITRE ATT&CK T1059.001 — PowerShell](https://attack.mitre.org/techniques/T1059/001/)
- [MITRE ATT&CK T1059.002 — AppleScript](https://attack.mitre.org/techniques/T1059/002/)
- [MITRE ATT&CK T1555.001 — Keychain](https://attack.mitre.org/techniques/T1555/001/)
- [MITRE ATT&CK T1554 — Compromise Host Software Binary](https://attack.mitre.org/techniques/T1554/)
- [MITRE ATT&CK T1608.006 — SEO Poisoning](https://attack.mitre.org/techniques/T1608/006/)
- [MITRE ATT&CK T1036.005 — Match Legitimate Name or Location](https://attack.mitre.org/techniques/T1036/005/)
- [Inno Setup official site (legitimate installer toolkit abused by attacker)](https://jrsoftware.org/isinfo.php)
- [OpenAI — official ChatGPT site (legitimate brand being impersonated)](https://chatgpt.com/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-0614