Project
Google's free website-building and hosting service, often abused by phishing and malware campaigns to host fake download or landing pages.
Zscaler found Ledger phishing ads running under a verified Google advertiser, with Vercel redirect domains rotating every 15 to 20 minutes. The ad displayed google.com and the pages sat on Google and Vercel hosting, so domain reputation and the verified badge gave defenders little to catch.
Reality
Huntress traced a RAT campaign that hides its first-stage lure in a ChatGPT Custom GPT on the real chatgpt.com, across at least 40 incidents. Because the page sits on a trusted domain, blocking the ClickFix PowerShell paste is the control that works.
Perspective Coverage
8 publishersReality
Huntress traced at least two of more than 40 ClickFix malware incidents to fake custom GPTs on OpenAI's chatgpt.com. On that route every hop before the PowerShell command sat on a Google or OpenAI address, so staff taught to trust familiar domains would click through each one.
Reality
Cato Networks says a sponsored ad outranked OpenAI's own page, sending macOS developers to a Google Sites portal whose ClickFix content lives on infrastructure Google never hosted.
Perspective Coverage
3 publishersReality
Cato says a sponsored result for "codex macos download" leads to a Google Sites clone whose Terminal command strips quarantine flags and stages an AMOS-linked payload.
Reality