THREAT REPORT - AI-TARGETED CLOAKING

You asked an AI if the site was safe. What if the scammer wrote the answer?

Pasting a suspicious link into ChatGPT or Perplexity has quietly become one of the most common safety habits on the internet. A growing set of scam pages has noticed, and now checks who is knocking before deciding what to show.

SB

SafeBrowz Threat Research Security ResearchAugust 9, 20268 min read

The habit that changed the target

Ten years of security advice trained people to ask someone before clicking. For a long time that someone was a colleague, a bank's fraud line, or a search engine. Now it is very often an assistant. You paste the link, you ask whether it looks legitimate, and you get a confident paragraph back in a couple of seconds.

That habit is a genuine improvement on clicking blind. It also created a new thing worth attacking. If a scammer can control what the assistant sees, they do not have to fool you at all. They only have to fool the one fetch that produced your answer, and then let your own trust in the tool do the rest.

The uncomfortable part is how little effort that takes. When SPLX published its work on what it named AI-targeted cloaking, the mechanism was not some exotic exploit. It was, in the researchers' description, a trivial user agent check that leads to content delivery manipulation. A single conditional rule on the server, of the shape "if the visitor says it is ChatGPT, serve this other page instead".

Why the trick works so cleanly on assistants

Every automated visitor announces itself. When an assistant fetches a page on your behalf it sends a user agent string that names the crawler doing the fetching, because that is the polite convention the whole web runs on. Publishers rely on it to allow or block AI training. Site owners rely on it to keep analytics honest. It is a feature, not a flaw.

A scammer just reads the same string for the opposite purpose. If the request announces one of the AI crawlers, the server returns a plain, unremarkable page: a recipe blog, a small business homepage, a parked notice. If the request looks like a phone or a laptop, the server returns the real payload. Nothing is compromised, nothing is exploited. The site simply answers two different questions with two different pages.

What makes this land harder than ordinary cloaking is the retrieval model behind modern answers. SPLX's point was that these systems rely on direct retrieval, so the fetched page is not one input among many, it becomes the ground truth the summary is written from. A search engine that gets cloaked still shows you a list of results you can weigh. An assistant that gets cloaked hands you a single confident conclusion with the doubt already removed.

It is not theoretical: the LLMShare campaign

The clearest recent case did not even need the victim to ask a question. Push Security documented a malvertising campaign it called LLMShare (summary), confirmed across customer environments on 29 May 2026, which bought Google Ads against ChatGPT-related searches. Clicking the ad sent people to a genuine chatgpt.com shared-conversation URL that hosted the lure, which then pushed them to a fake OpenAI download portal on the attacker's own domain, openew[.]app. That domain stopped resolving after the takedown, and we have added it to our blocklist so it stays flagged if the operator brings it back. Click it to run it through the scanner yourself.

Push Security's write-up contains the line that should be pinned above every "I checked it and it was fine" conversation: when security tools like URLScan visited the site, they were redirected to a harmless website for a legitimate company instead of the fake download page. Automated visitors got a clean company site. Humans got a stealer. On macOS the payload was Odyssey Stealer, going after credentials, cryptocurrency wallets and session tokens.

Notice what that campaign borrowed. The visible hop was on a real OpenAI domain, so the link looked impeccable, in the same borrowed-trust way we broke down in the chain that starts on google.com. Cloaking then covered the rest. Reputation said fine, the scanner said fine, and the only visitor who saw the truth was the one with a credit card and a wallet.

How common is this, really

Cloaking is not new and it is not rare. It is the standard way phishing infrastructure buys itself time. Academic work has been measuring the cost it imposes on defenders for a while: in PhishParrot, published on arXiv in August 2025, researchers Hiroki Nakano, Takashi Koide and Daiki Chiba describe attackers using cloaking to display phishing sites only to specific users while presenting legitimate pages to security crawlers, and built a system that learns what profile a given site wants to see. Over a 21-day evaluation their adaptive approach improved detection accuracy by up to 33.8 percent over standard analysis, and it needed 91 distinct crawling environments to cover the conditions attackers were targeting.

Sit with that number for a moment. Ninety-one different pretend visitors, just to get cloaked pages to drop their guard. That is the size of the problem for anyone fetching a page once and judging it. AI crawlers are simply the newest and most predictable profile on that list, and the most valuable one, because their verdict arrives pre-packaged as advice.

We have written about the same evasion wearing other costumes: a fake Cloudflare error page that hides a smishing site behind what looks like an outage, and the FBI advisory on cloaked redirects feeding traffic distribution systems. The technique is constant. Only the audience being lied to keeps changing.

Four things to check before you trust the answer

None of this means an assistant is useless for link safety. It means you should know what its answer is made of, and add a couple of steps it cannot do for you.

1. Ask what it actually looked at. If the reply describes the page in generic terms with no specifics, it may be summarising the domain's reputation rather than reporting on a page it fetched. Ask it directly whether it opened the link and what was on it. A vague answer is not a safe answer.
2. Judge the final address, not the first one. The LLMShare lure lived on a real OpenAI URL. Big, trusted hostnames at the start of a link tell you nothing about where it ends, which is exactly why unwrapping a shortened or wrapped link is worth the ten seconds.
3. Treat a download prompt as the end of the conversation. Almost every case in this pattern converges on the same ask: install this app, run this update, paste this command. A real service does not need you to fetch software from a page you arrived at through an ad. That instinct also defeats the fake CAPTCHA "paste this to verify" trick, which is the same play with a different costume.
4. Get a second opinion from something that opens the page as a person would. A verdict is only as good as the visit behind it. Anything that fetches the page while announcing itself as an automated tool is exactly the visitor these sites are watching for.

Check the link yourself instead of trusting the summary

This is where a browser-side tool has an advantage that no chat answer can copy, and it is worth being precise about why.

SafeBrowz runs three layers. The first is local, inside the extension: URL-shape checks, 60+ suspicious URL and urgency patterns, and homoglyph and Punycode detection, all before a page renders and without a network call. The second is server-side reputation and list checks, where a database of 550+ impersonated brands, threat feeds and blocklists decide whether the destination is a known-bad or a lookalike of something real. The third is an AI read of the page content in over 100 languages, which is the layer that catches a convincing new fake nobody has reported yet.

For a suspicious link the faster layers cannot settle, SafeBrowz Premium adds a behavioural check inside that third layer, not a separate fourth one: the link is opened in an isolated, disposable browser and judged by what the page actually does. Hidden redirects, forced downloads, wallet-drainer scripts and ClickFix-style "paste this command" prompts show up as behaviour, and behaviour is much harder to fake than a page of text, because the page has to perform the attack to be an attack.

Honest scope, because it matters more than the pitch. The behavioural check is a Premium feature and it runs on suspicious links, not on everything you browse. It works from threat-intelligence research and our brand database rather than any record of where individual people go, and we keep no per-user browsing history. And a page determined enough to stay silent for every automated visitor can still stay silent for us, which is precisely why the layers are stacked rather than swapped: a site that dodges one of them still has to get past the others. SafeBrowz is free for the core protection, with Premium at $14.99 a year, on Chrome, Firefox and Edge, plus the Android app, with Safari on the way.

What this changes about asking an AI

Keep asking. Getting a second opinion before you click is a good instinct and it stops far more trouble than it causes. Just hold the answer the way you would hold a friend's opinion rather than a lab result, because the assistant is describing a page that a stranger chose to show it.

The wider lesson is one this site keeps arriving at from different directions. Trust follows infrastructure now, not brands. A link on a real Google domain, a lure on a real OpenAI URL, a verdict from a real assistant: each of those is genuinely what it claims to be, and none of them is evidence about the thing at the end. The question worth asking is never "does this look official" but "what happens when this actually opens", and that is a question you want answered somewhere other than your own device.