# MA-931.042023: MyCERT Alert - RedLine Stealer Behind ChatGPT, Google Bard Facebook Ads

**Date:** 20 Apr 2023  
**Source:** https://www.mycert.org.my/portal/advisory?id=MA-931.042023  
**Advisory ID:** MA-931.042023

---

**1.0 Introduction**
The popularity of generative AI platforms like Google Bard and OpenAI’s ChatGPT has captured audiences worldwide. Google Bard is an artificial intelligence (AI) language model developed by Google that uses deep learning techniques to generate poetry and lyrical verses. It leverages large amounts of text data to compose original and creative poems in various styles and forms, such as sonnets, haikus, and free verse. Google Bard's output is known for its coherence, rhythm, and imagery. It is a valuable tool for writers, poets, and artists seeking inspiration or looking to enhance their creative works with evocative language. Also, ChatGPT is a large language model developed by OpenAI based on the GPT-3.5 architecture. It is an advanced AI chatbot trained to understand and generate human-like text responses. ChatGPT can interact with users on various topics, providing information, answering questions, and generating text-based responses. It is designed to understand context, contextually respond to user queries, and provide detailed and coherent responses. ChatGPT has been trained on a vast amount of text data, allowing it to generate fluent and coherent text, and making it a powerful tool for various applications, including customer service, content creation, and virtual assistance.
Security experts uncovered a new campaign to spread the RedLine Stealer malware strain by taking advantage of the popularity of these AI platforms. The malware was first spotted in March 2020, Redline Stealer is **a piece of malware that specifically targets end users**. Distributed through compromised software downloads, phishing, and drive by downloads. RedLine Stealer is a type of malware sold as ‘malware-as-a-a-service’ (MaaS), which can be purchased on underground forums. It is designed to steal sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data. In addition, it can take an inventory of the target machine, gathering information on the user, location, hardware, and installed security software. The malware can upload and download files, execute commands, and regularly send information about the infected computer to the perpetrators.
**2.0 Impact**
Successful execution of the malware at victims’ computers allows sensitive information from web browsers, including credit card details, saved credentials, and autocomplete data will be stolen from the victims’ computers. In addition, it can take an inventory of the target machine, gathering information on the user, location, hardware, and installed security software.
**3.0 Technical Details**
The MaaS ecosystem is supported by online discussion boards that serve as markets for hackers to sell their malware and stolen information. Access to viruses, stolen data, and even hacking tools are just a few of these forums' services. Sometimes, forum moderators serve as a middleman between buyers and sellers and receive a revenue cut.
Figure 2: Screenshot of the RedLine Stealer Malware Ad, used for the Open AI campaign in Dark Web Marketplace
On the dark web, malware employed in the attacks can be sold for $100 to $150. One-time purchases or monthly subscriptions are the two ways it is offered for sale.
Figure 3: The different Malware bundles available to purchase
After acquiring and using the malware, hackers sell the stolen information to other hackers specialising in online fraud in dark web forums, allowing them to concentrate on their illegal business model. They primarily utilise the messaging service Telegram to buy and disseminate RedLine Stealer malware since it offers more secrecy and encryption for their operations.
**3.1 Modus Operandi - Using Facebook**
The modus operandi of the RedLine Stealer malware is stealing login credentials from popular Facebook communities or company profiles with thousands of followers. The perpetrators then spread sponsored posts encouraging users to download free the “alleged” ChatGPT or Google Bard files, as shown in Figures 4 and 5.
Figure 4: Facebook post advertising to download ChatGPT-V4
Figure 5: Facebook post advertising to download Google Bard
The above FB posts intend to lure unsuspecting users by making the posts appear legitimate and entice users to click the attached link containing the malicious file to download ChatGPT and Google BARD. Such tactics exploit the recent enthusiasm surrounding open language models such as ChatGPT. After a user downloads and extracts the file, the RedLine Stealer malware is executed, allowing the stealing of sensitive information from the user’s computer.
The two links attached to the suspicious FB posts are as below:
1. Download ChatGPT: 
hXXps[:]//sites.google[.]com/view/chatgpt4hgfhgf/home?
2.Download Google BARD:                                                                                                                                                                                                                                          hXXps[:]//trello[.]com/1/cards/642e42b9121144ce28ea44aa/attachments/64358719d3e515fa48696b0f/download/setup\_chatgpt[.]rar
Based on our checking, hXXps[:]//sites.google[.]com/view/chatgpt4hgfhgf/home? will have a download button that points to the following URL: hXXps[:]//trello[.]com/1/cards/642e42b9121144ce28ea44aa/attachments/64358719d3e515fa48696b0f/download/setup\_chatgpt[.]rar
The above malicious file is password protected; nevertheless, a password is attached to the FB posts, as seen in the sample post in Figure 5, to enable opening the file. Password-protecting malicious files is commonly used by perpetrators to evade detection.
MyCERT was able to download a copy of the .rar file and successfully opened and extracted the file using the password provided in the FB post. Our analysis confirms that the .rar file is indeed loaded with the RedLine malware. Currently, the link containing the RedLine malware in a .rar file is still accessible online.
**4.0 Recommendations**
Internet users must be vigilant of the risks of downloading and operating files from unknown sources.
1. Users must always refer to the respective vendor websites to download applications provided by the respective vendors.
2. Users should be wary and suspicious of applications circulated on social media for downloads.
3. Users must not simply click on any links or executables they receive via social media and other messaging applications.
4. Enable and use up-to-date anti-virus software to detect and remove malicious files before they can cause any damage.
5. Do regular security updates and patches.
6. Contact relevant authorities such as CyberSecurity Malaysia for inquiries and assistance 
7. Users are also encouraged to report to the Service Providers or the social media platform concerning the circulation of posts or ads with suspicious links.
Generally, MyCERT advises the users to be updated with the latest security announcements by the vendor and follow best practice security policies to determine which updates should be applied.
For further enquiries, don't hesitate to get in touch with MyCERT through the following channels:
E-mail: cyber999[at]cybersecurity.my 
Phone: 1-300-88-2999 (monitored during business hours)  
Mobile: +60 19 2665850 (24x7 call incident reporting) 
Business Hours: Mon - Fri 09:00 -18:00 MYT 
Web: <https://www.mycert.org.my> 
Twitter: <https://twitter.com/mycert> 
Facebook: <https://www.facebook.com/mycert.org.my>
**5.0    References**
1. <https://veriti.ai/blog/research/from-chatgpt-to-redline-stealer-the-dark-side-of-openai-and-google-bard/>
2. <https://www.darkreading.com/attacks-breaches/attackers-hide-redline-stealer-behind-chatgpt-google-bard-facebook-ads>
3. <https://www.threatshub.org/blog/attackers-hide-redline-stealer-behind-chatgpt-google-bard-facebook-ads/>
4. <https://www.mycert.org.my/portal/details?menu=431fab9c-d24c-4a27-ba93-e92edafdefa5&id=b1755f12-8a92-481b-b0c9-f96b5095dbdd>
5. <https://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer>
6. <https://securityscorecard.com/research/detailed-analysis-redline-stealer/>
7. <https://www.pcrisk.com/removal-guides/17280-redlinestealer-malware>
8. <https://blog.avast.com/redline-stealer-malware>