ChatGPT's Own Infrastructure Turned Into Phishing and Malware Delivery Platform

Two separate research disclosures landed on the same day showing how OpenAI's own platform is being turned against its users — while SpaceX quietly collected over ten billion dollars in government contracts before the weekend.

Security

The ChatGPT threat doubled up. BleepingComputer reports that attackers are abusing ChatGPT's shared-conversation URLs to host fake OpenAI outage pages that push malware disguised as the ChatGPT desktop app — legitimate-looking chat.openai.com links serving attacker-controlled content. Separately, researchers disclosed ChatGPhish, a vulnerability exploiting ChatGPT's implicit trust in Markdown-embedded links and images to trigger prompt injection, converting the model's web-summary feature into a phishing launchpad. Both attacks abuse trust in the OpenAI brand and neither requires compromising OpenAI's backend — only the features working exactly as designed.

California Attorney General Rob Bonta filed suit against 23andMe — now operating as Chrome Holding Co. following bankruptcy — over the 2023 breach that exposed genetic and health data for millions of customers. The suit argues the company failed to protect uniquely sensitive biometric data with adequate safeguards. With the company in restructuring, whether any judgment will be collectible is an open question, but the action sets a public record on what minimum-security obligations attach to genetic databases.

A public feud between Microsoft and an independent security researcher escalated sharply, with Microsoft reportedly threatening criminal investigation after the researcher published Windows exploit details. The Register notes the researcher has since threatened another dump. Legal pressure on researchers does not patch vulnerabilities; it delays disclosure while the attack surface stays open and the researcher's credibility — and threat — grows.

AI

Groq is reportedly raising $650 million in internal funding and pivoting from custom LPU hardware toward AI inference software, following Nvidia's $20B not-acqui-hire that left Groq technically independent but deeply Nvidia-adjacent. The pivot is a signal: chip differentiation alone is not a durable moat when inference orchestration and optimization are where the margin actually lives.

At Computex, Nvidia, Microsoft, and Arm are openly teasing the N1X, Nvidia's first Arm-powered laptop chip. Microsoft is simultaneously teasing new Surface hardware and "a new era of PC." Qualcomm's head start in Windows-on-Arm now has a direct and well-resourced challenger — one that arrives with a GPU ecosystem story Qualcomm cannot match.

Meta's internal memo revealed plans for a new AI pendant as part of a broader wearables expansion beyond the Ray-Ban glasses line. Always-on ambient AI context you wear rather than carry is the stated goal; power budget and social friction remain the binding constraints, as they have been for every always-on wearable since Google Glass.

The UK government announced AI will be used to estimate the age of asylum seekers beginning next year. It is one of the more consequential government AI deployments in recent memory: model error rates translate directly into potential wrongful detention or deportation. No published error rate benchmarks accompanied the announcement.

A TechCrunch investigation into coders refusing to work without AI documents a structural concern researchers are increasingly raising: developers losing the ability to read, debug, or reason about code they did not write. Output velocity is up; the long-tail risk is a generation of engineers who cannot function when the model is wrong.

Tech

SpaceX had a remarkable day in government contracting. The company secured $6.45 billion in Space Force contracts ahead of its IPO — government revenue already represents a fifth of its 2025 total — and separately received a $4.16 billion Pentagon award to build missile-tracking satellites for Trump's planned "Golden Dome" defense system. More than ten billion dollars in a single day makes the upcoming IPO look considerably less speculative than the filing alone suggested.

The California State Assembly passed the "Protect Our Games Act", requiring publishers to ensure continued game playability after server shutdowns. It is the strongest legislative win yet for the Stop Killing Games movement and, if signed, would establish a precedent with national reach for how digital goods are treated under consumer protection law.

The White House's Office of Management and Budget proposed new grant rules that would make peer review optional and give political appointees final approval over federal research funding — including authority to cancel any grant at any time for any reason. It follows earlier attempts that were blocked and represents a structural redesign of how publicly funded science is prioritized in the United States.

An Indian court ruling against Google's keyword ad practices is drawing support from founders globally, with lawyers noting it could force major platforms to revisit how trademarked keywords are handled in paid search — a fight that has been mostly settled in Google's favor in Western courts for over a decade.

The day's throughline: infrastructure that wasn't designed for adversarial use — shared AI links, federal science pipelines, game servers, brand-trusted URLs — keeps getting stress-tested by actors who had no hand in building it and no obligation to maintain it.

Also yesterday

• Protestware in jqwik Instructs AI Coding Agents to Delete Your App Output
• Kimsuky Weaponizes VS Code Tunnels in Active APT Campaign Against Corporate Networks
• Charter Communications Breach Exposes 4.9 Million Accounts to ShinyHunters
• Dutch Authorities Dismantle 17-Million-Device Botnet, Seize 200+ Servers