Cybercriminals continue to abuse the artificial intelligence hype in the form of ChatGPT, Sophos has recently warned. The IT security company has discovered various apps that claim to be ChatGPT-based chatbots in the official Apple and Google app stores. The apps rake in disguised, high fees.
The malware analysts describe the functions of the apps as largely useless. They would have zero functionality and would constantly display advertisements in the free trial version to encourage potential victims to purchase a paid subscription.
App-Store: Fake-Chatbot-Apps
In the analysis, Sophos IT researchers describe an app in Google’s Play Store that behaves in a similar way to many others of this genre: the app, which was initially advertised as free, was heavily loaded with advertising and stopped the function after three uses – with the note that a subscription should be taken out for use in order to update the software for future uses. The prices amounted to 10 US dollars per month after a three-day trial, alternatively interested parties could pay 30 US dollars for a yearly subscription.
The “pro features” that potential victims pay for are essentially the same as those that registered users get with ChatGPT. If and as long as they work, Sophos restricts them. In the thousands of scarce four-star ratings, there are comments from people for whom the app didn’t work at all. Either it only showed ads or it didn’t respond to requests made after it was unblocked. One user even commented that the app simply replied to every request: “Sorry, I couldn’t understand your message”.
Sophos’ IT researchers found an almost identical app from the same provider, but with a different name, in Apple’s App Store for iOS. The app behaved essentially the same as its Android counterpart, but the weekly subscription fee was $6. After a recent update, the app only responds to requests with an abbreviated response and a “Read more…” link at the end. Apparently it uses OpenAI’s ChatGPT API, but doesn’t return complete and useful answers.
Clicking “Read more…” leads to the subscription nag screen, complete a three-day trial, or pay upfront for a monthly or yearly subscription. The app’s limit is now ten requests per day, at the end of which users are introduced to the “Premium Subscription” screen.
Fake apps: lucrative business
The business is lucrative for the fake app providers. Sophos reports that the Android app brought in $5,000 in March, and the iOS version even $10,000. And that despite increasing negative ratings for the apps.
IT analysts have uncovered numerous similar apps in both Apple’s and Google’s app stores. They all take advantage of the naming similarities to ChatGPT for better rankings in the stores’ search function. The apps were within the gray area of the terms of use of the app stores or partially exceeded them. For example, one app showed a subscription nag screen that took minutes to be clicked away by an “X” that appeared. Other apps interrupted the responses with requests to rate the app, saying it violated Apple’s guidelines.
Sophos is still providing information on how victims can get rid of the subscriptions. Under iOS, the point in the settings app can be reached after tapping your own name, where there is the sub-item “Subscriptions”. There the entry to be changed must be tapped and the desired change made. On Android, the options can be found in the Google Play Store. After tapping on your own picture, the active subscriptions can be found under “Payments and subscriptions”, then via “Subscriptions”. They can also be adjusted there.
Cyber criminals have been jumping on the ChatGPT hype since the beginning of the year. Other IT security researchers are now complaining that Apple rarely deletes the wrong ChatGPT programs.
(dmk)
