A fake ChatGPT verification can put your shop computer at risk

Suppose you're drafting a pickup reminder on the counter computer between customers, and someone asks you to "verify you're human."

If you run a dry cleaner in Carmel, you might try to finish that draft before answering the phone. Stop if the page asks you to open Windows Run and paste a command. Close the page before you try to finish the reminder.

On October 1, 2026, Island researchers described an attack that started with sponsored results for searches such as "chatgpt." Attackers sent visitors through content on real ChatGPT pages, then directed them to a supposed backup site with a fake verification check.

I checked the investigation for the point where you could stop the attack.

How did a ChatGPT search turn into a scam?

The attackers claimed ChatGPT was busy and offered another site, where they impersonated ChatGPT and Cloudflare.

The attackers instructed visitors to open Windows Run, paste clipboard contents, and press Enter. Through those steps, they tried to make the visitor run a command that downloaded malicious software.

Security researchers call this method ClickFix: someone persuades you to run a harmful command while claiming you're fixing an error or proving you're human. Microsoft describes the same trick and warns that legitimate verification checks don't require those commands.

Island's researchers observed activity through August 2026. They don't say whether the attackers still run the campaign.

What should your staff watch for?

Focus on the action the stranger asks you to take. A familiar logo gives you little help once someone tells you to leave the browser and run instructions on your own computer.

Close a verification page if it asks you to open Windows Run or paste a command outside the browser.

You don't need to learn what the command means. Someone can hide instructions in the clipboard, so the text you think you copied may differ from what you paste. You can close the page and ask for help without testing it.

For the Carmel dry cleaner, I'd bookmark the normal ChatGPT home address, https://chatgpt.com/, on the counter computer. Staff can open that bookmark when they want help drafting a pickup reminder. A bookmark reduces the need to search for the service; you still need to check any request that follows.

At an auto repair shop in Noblesville, the owner might ask an office assistant to use AI for an explanation of a service interval. Agree in advance that the assistant should call the owner if a page asks for a computer command or an unfamiliar backup site. Give the assistant permission to leave the draft unfinished while they check.

Use these hypothetical routines alongside our one-task trial for a business AI tool: choose a small job, review the result, and keep a person responsible for decisions.

What if someone followed the prompt?

Tell your staff whom to contact before they need that person. If someone says they ran a suspicious command, thank them for telling you and stop using that computer for business accounts.

In its June 8, 2026 CAPTCHA scam warning, the FTC recommends disconnecting from the internet and scanning for malware. It also advises using a different device to change passwords and turn on two-factor authentication. Microsoft advises disconnecting an infected computer from its networks, including wired connections, Wi-Fi, and Bluetooth.

Call your trusted computer support person for help checking the device. Use a separate, trusted device to secure affected accounts. Tell the support person which business systems you used on the computer so they can assess the exposure.

You may keep supplier email and customer records on the same desk where you print receipts. Tell your support person which accounts might need attention.

Keep that contact beside the monitor

Spend ten minutes with the people who use your computer. Tell them you want a quick report even if they already clicked, and give them the phone number they should call.

For the website itself, our fifteen-minute check covers a different maintenance job, including whether customers encounter a security warning. If you're planning a new site or connecting a custom tool to your shop's records, our services page explains the work we do. Ask whoever builds it to explain how you'll get support after launch.

Write the support number on paper. The person who needs it may be standing beside a computer they've had to disconnect.

---

Sources

#	Source	What it backed up
1	Island: How attackers use sponsored search and custom GPTs in malware delivery	October 1, 2026 report of sponsored-search delivery, real ChatGPT routes, fake backup sites, and observations through August.
2	Microsoft: Behavior:Win32/ClickFix	Clipboard tricks, command-based fake verification, and disconnecting an infected device from networks.
3	FTC: How to spot a CAPTCHA scam	June 8, 2026 warning and account-recovery steps using a different device.
4	Luminest: Meta Muse for small business	Related advice on trying one AI task with human review.
5	Luminest: The fifteen-minute broken website test	Related website maintenance checks, including browser security warnings.