Security Researchers Unveil ChatGPhish: New Vulnerability Manipulates ChatGPT Summaries, Exposing Users to Phishing Risks

Security researchers have introduced ChatGPhish, a newly identified vulnerability that highlights how browser-based prompt injection can alter ChatGPT page summaries. This manipulation poses significant risks, exposing users to phishing, tracking, and social engineering attacks. The implications of this vulnerability extend beyond mere technical concerns, raising questions about trust in AI-driven interfaces.

The research builds on previous findings related to AI-assisted email summarization. Earlier studies demonstrated how attacker-controlled content embedded in emails could mislead large language models (LLMs) into generating deceptive responses within trusted environments. The latest findings expand this concept from email into the broader web environment, presenting a wider attack surface where common web pages can serve as delivery mechanisms for malicious content.

Browser-Based Prompt Injection Expands the Attack Surface

Unlike email attacks, which often face barriers such as spam filters and user training, browser-based attacks require minimal user interaction. A victim merely needs to visit a web page and request a summary through an AI-powered feature. This simplicity makes browser-based vulnerabilities particularly concerning.

Researchers noted that modern web activities frequently involve various platforms, including documentation portals, GitHub repositories, blogs, SaaS dashboards, and internal portals. Any of these could potentially become vectors for attack if their content is processed through an LLM summarization workflow.

During testing, researchers utilized Firefox as the entry point. After navigating to a web page and invoking ChatGPT’s summarization feature, the page content was supplied to the model. The embedded attacker-controlled instructions within the page influenced the generated summary, which was then displayed in ChatGPT, complete with rendered links and images.

It is crucial to note that this is not a vulnerability specific to Firefox. The browser merely facilitates access to the page summarization workflow. The broader risk applies to any browser-integrated LLM system that renders untrusted Markdown content without a clear distinction from trusted assistant-generated output.

How ChatGPhish Demonstrates Phishing Within ChatGPT

One of the primary demonstrations involved injecting a fake security notification into a legitimate web page. In a proof-of-concept scenario, an attacker appended instruction-like content to a page that otherwise appeared legitimate, such as a GitHub README or a product website. This injected content directed the model to follow a specific response structure when summarizing the page.

The malicious prompt instructed the assistant to generate a standard page summary, followed by an alert claiming that “a new device was added to your account: Chrome on Linux (Pristina).” This message included a clickable link leading users to an attacker-controlled website.

Researchers observed that ChatGPT produced a legitimate summary of the page before appending the attacker-controlled alert. The phishing URL appeared alongside the summary in a manner that could easily be mistaken for an official notification from the platform itself. This behavior illustrates how a prompt injection vulnerability can transform external web content into seemingly trustworthy information generated by the assistant.

QR Code Delivery Creates a Cross-Device Threat

The ChatGPhish research also explored a more sophisticated attack method involving QR codes. While traditional phishing links are visible to users and often subject to browser protections, QR codes shift the interaction to a separate device. Users scanning a code with a smartphone may not see the underlying destination URL until after the scan occurs.

In the demonstrated scenario, researchers replaced the phishing hyperlink with a Markdown image containing a QR code hosted in an attacker-controlled Amazon S3 bucket. Because the ChatGPT renderer automatically fetched and displayed the image, the QR code appeared directly within the assistant’s response.

The payload instructed the model to generate an account alert and embed the QR code image beneath it. Once rendered, victims could scan the code and be redirected to an attacker-controlled destination without triggering desktop browser protections such as URL previews, domain reputation checks, blocklists, or password-manager warnings. This QR-code technique represents a more dangerous variation of the attack, as it bypasses many traditional desktop security controls.

The findings from this research underscore the evolving landscape of cybersecurity threats associated with AI technologies. As AI systems become more integrated into everyday applications, the potential for exploitation through vulnerabilities like ChatGPhish raises critical concerns about user safety and trust.

For further insights into this vulnerability and its implications, refer to the original reporting source: thecyberexpress.com.

Keep reading for the latest cybersecurity developments, threat intelligence and breaking updates from across the Middle East.