What you need to know
The risk: AI chatbots can help you find products, download software or locate websites, but the links they recommend aren't always safe. Gen Threat Labs found examples of ChatGPT directing users to fake online stores, phishing websites and malicious downloads. Sometimes, even legitimate websites recommended by AI had been compromised by criminals.
The scale: Over 90 days, Gen security products blocked more than 260,000 threat-related events associated with AI chat services, including dangerous links and attacks hosted on AI platforms.
Our advice: Don't assume a website is trustworthy just because an AI chatbot recommended it. Double-check website addresses, be cautious when shopping at unfamiliar stores, and keep your security protection enabled.
For years, cybercriminals have manipulated search results to put fraudulent stores, malicious downloads and phishing sites in front of people searching for legitimate services. The practice is generally known as SEO poisoning. As more people use AI assistants to find websites and products, similar risks are beginning to appear in chatbot answers.
People are getting used to asking chatbots for recommendations rather than searching for things themselves. And when an assistant gives you a helpful answer with a link to a website, it's easy to trust that recommendation without checking where it leads. Criminals can take advantage of that trust, particularly when they manage to get a fake store or malicious website included in an AI-generated answer.
Our investigations uncovered several examples, including ChatGPT recommending a fake EcoFlow store, directing someone looking for legitimate software to a website distributing an infostealer, and linking to a respected journalism organization whose website had been compromised to redirect visitors to scams. Over the 90 days covered by our research, more than 121,000 Gen users were protected from threats associated with AI chat services.
We should also consider what happens as AI assistants start doing more things on our behalf. AI agents can increasingly navigate websites, download software and interact with online services, sometimes without requiring the user to approve every step. The attacks we've investigated mainly involve people clicking links recommended by chatbots, but these same malicious websites could also pose a risk to AI agents. As we give AI more freedom to act for us, checking the safety of the websites it interacts with will become increasingly important.
From SEO poisoning to poisoned AI answers
Traditional SEO poisoning attempts to influence where attacker-controlled content appears in search results. Now, a newer discipline called Answer Engine Optimization (AEO) is emerging, focused on making websites and their content more likely to appear in answers and recommendations from AI assistants. As AI agents become more widely used, businesses are also adapting their websites to make it easier for these systems to find, understand and use their content.
Cybercriminals can exploit these same mechanisms to get malicious websites or manipulated information into AI-generated answers. This is where AI result poisoning comes in. MITRE ATT&CK added AI Result Poisoning as technique T1608.007 in 2026, describing how attackers can manipulate publicly available web content to influence what AI systems retrieve or recommend.
How do scam links end up in a chatbot's answer? We see four routes. First, the model can learn from poisoned data, so a bad recommendation is baked in before anyone asks. Second, the chatbot searches the web, finds content an attacker planted or a legitimate site the attacker has compromised, and passes it on as a citation or recommendation. Third, the model invents a plausible domain, such as a “.io” address for a well-known app, and a criminal registers it to carry out their scam. Fourth, the AI platform itself is only the host: attackers publish a lure in a shared conversation and send people there. From the outside we often cannot tell the first three apart. For the person who clicks, it makes no difference – all point to fraud.
Figure 1. Four ways cybercriminals can expose users to malicious links through AI services
In an earlier investigation, cybercriminals used Google sponsored search results to direct people to a shared Claude conversation that contained malicious macOS installation instructions. Users following the instructions could trigger a chain leading to Atomic macOS Stealer (AMOS). That was a case of abusing a legitimate AI platform to host the lure, not of Claude deciding to recommend it. Our current investigation also documents the second route, where harmful or compromised sites appear directly in AI-generated responses.
The 260,000 cases of scams originating from AI recommendations is a big pile, so here are just a few cases we pulled out of it: fake stores, malicious downloads, phishing pages and legitimate websites that had been compromised. They are not a complete list, only a sample that shows how these AI scams look in practice.
A lookalike Upscayl download carried an infostealer
Upscayl is a free, open-source image-upscaling application. Its official domain is upscayl.org, but in one of the cases we analyzed, someone asking ChatGPT for the project website was directed to upscayl[.]io instead. The lookalike site had no connection to the legitimate developer and offered a malicious download.
The downloaded archive contained an SQL Server Bootstrap Installer with a trojanized SQLSetupBootstrapper.dll. The attack used DLL hijacking and the legitimate Windows utility msiexec.exe to install information-stealing malware. Infostealers can harvest credentials and other sensitive information from an infected system, making what appears to be an ordinary software installation a potential route to account compromise and financial fraud.
Figure 2. The lookalike Upscayl site reached through a ChatGPT-associated link.
This case did not require a sophisticated conversation with the victim. The user wanted an application, the assistant supplied a plausible domain, and the malicious page was positioned to exploit that visit. The same technique has long worked through poisoned search results; a chatbot answer provides another path to the download.
Fake shops can turn up in AI shopping recommendations
Our investigators also found a ChatGPT recommendation for ecoflowofficial[.]shop, a fraudulent store impersonating EcoFlow, the maker of portable power stations and other energy products. The website copied the company's branding and retail presentation, but its domain was recently registered and it lacked basic business information, including a physical address, privacy policy and terms and conditions.
Figure 3. Fake EcoFlow storefront appearing in the investigation.
A second case started with a request for a cheaper military-style leather jacket. ChatGPT surfaced a retailer with four different phone numbers across its site and Facebook, two X accounts, negative reviews, and a checkout that offered only PayPal and required registration. When we repeated a similar prompt, ChatGPT recommended the same shop on the first attempt.
A legitimate source can deliver a malicious redirect
Some of the most instructive cases did not involve counterfeit domains. A user asked ChatGPT about press freedom in Peru and received a citation from the Asociación Nacional de Periodistas (ANP), the country's national press association. The source was appropriate for the subject, but attackers had compromised the website and installed code that profiled visitors before deciding whether to serve the original page or redirect them elsewhere.
Our telemetry recorded a user following the ANP citation from ChatGPT and being routed through a traffic distribution system (TDS) to a page associated with a scam kit commonly seen in malvertising operations. The TDS infrastructure was used to route visitors toward different forms of abuse, including phishing, fake shops and credential-theft sites, according to the investigation.
Figure 4. Attack path documented by Gen Threat Labs: a real citation from ChatGPT leads to the compromised ANP site; visitor profiling determines whether the browser receives the article or a redirect to malicious infrastructure.
As this case shows, even a legitimate and trusted website can expose visitors to malicious content if it has been compromised. ChatGPT retrieved the original article on the APN website and found nothing unusual, but when the user followed the link, attackers redirected him to a scam. The criminals were using cloaking techniques to show different content depending on who was visiting the website, meaning that even an automated security check performed by the AI platform could have missed the threat if it received the legitimate content.
This is why we need an additional layer of protection that checks what actually happens when someone visits a website, rather than relying only on what the AI assistant saw earlier. And as AI agents start browsing websites and performing tasks on our behalf, that independent protection becomes even more important.
Compromised retailers and EtherHiding-based ClickFix attacks
We saw a similar problem at a legitimate Australian medical-supplies shop. ChatGPT cited it as a shopping source, but its page carried an injected script that loads further malicious code through blockchain infrastructure (an EtherHiding-style technique). Related compromised sites, from bus tickets to real estate and forums, sent visitors into ClickFix pages that tell them to paste a command into PowerShell.
Cybercriminals have used compromised websites, malicious redirects, cloaking and social engineering for years. Now we're seeing these same techniques affect people who follow links recommended by AI chatbots, even when they're simply looking for information, products or services.
Investment scams and phishing pages in chatbot links
On September 13, 2026, our telemetry recorded a ChatGPT referral to BitGPT Pro, supposedly an AI-powered trading platform with no verifiable product or company details. Its main job was to collect names, phone numbers and email addresses, and it used browser fingerprinting and more than 30 language versions. We also saw chatbot links to phishing pages impersonating Netflix and Microsoft; the fake Microsoft login sent credentials straight to the attackers.
Figure 5. BitGPT Pro registration page investigated after a direct ChatGPT referral. Researchers identified a contact-collection funnel and visitor-profiling functionality.
Why an AI crawler and a visitor may see different pages
Cybercriminals have been using cloaking for years to evade detection by search engines and security tools. Their websites can check a visitor's IP address, location, browser or operating system and decide what content to display. An automated crawler might see a perfectly legitimate page, while a regular user visiting the same URL gets redirected to a scam or a website distributing malware.
The same techniques can work against AI assistants. When ChatGPT retrieves information from a website, it may see legitimate content and include a link in its answer. But when someone clicks that link, the website can recognize the visitor and redirect them to a malicious destination. Attackers can also compromise a legitimate website after the AI assistant has accessed it.
AI platforms have their own security measures, but attackers are constantly looking for ways around them, just as they have done with search engines for years. Our investigations show why users shouldn't automatically trust a website simply because an AI chatbot recommended it.
How people can reduce their risk
When an assistant recommends a software download, check the developer's official domain before installing it. A familiar project name in the address bar is not enough, particularly when a lookalike site is distributing a modified installer. For unfamiliar stores, verify the business independently, including its contact details, policies, reputation and relationship to any brand it claims to represent.
Be cautious with investment sites offering unusually attractive opportunities but little verifiable company information. Treat unexpected login screens, CAPTCHA-like instructions to run commands and AI-shared installation guides with similar skepticism. Keep browser and security protections enabled, including when the link originated from a trusted assistant rather than an email, message or search result.
Helping people live Fearless in the AI era
Gen is already protecting people against many of the threats we've described in this investigation. Our web protection helps block malicious websites, phishing and scams, including those reached through AI chatbot recommendations. This is particularly important when dealing with compromised websites or malicious redirects, where the content a user encounters may be different from what the AI assistant saw earlier. We also use AI to help people identify scams, with solutions such as Norton Genie Scam Detector.
As AI assistants become more capable and start performing tasks on our behalf, we need to extend that protection beyond traditional browsing. This is one of the reasons we developed the Gen Agent Trust Hub (ATH), which helps assess the safety of AI agents and the tools they use, monitor their activity and intervene when they attempt potentially dangerous actions.
Our goal is to help people benefit from AI without exposing themselves to unnecessary risks, whether they're browsing the web themselves or relying on an AI agent to do things for them. Cybercriminals will keep finding new ways to abuse these technologies, and our job is to anticipate those threats and protect people from them.
That's how we help people live Fearless.
