Fake ChatGPT Desktop App Ads Used to Push Password-Stealing Malware

Multiple active threats reported: fake “ChatGPT” desktop app ads distributed password-stealing malware by abusing trusted AI links, hiding payloads from scanners and tricking users into downloads; attackers abused Meta’s AI support bot to bypass checks and hijack major Instagram accounts (issue observed in video evidence and later fixed by Meta); a WordPress malware campaign used Steam Community profile comments to encode and hide C2 instructions, impacting ~1,980 sites; and a zero-click XSS in pretalx allowed hijacking of conference organizer accounts (patched in v2026.1.0). These incidents涉及