Fake ChatGPT, DeepSeek or Gemini app installs malware that drains your bank account
Criminals distribute fake installers and apps impersonating ChatGPT, DeepSeek, Claude, and Gemini via social media ads, messaging apps, and lookalike sites. Once installed, banking trojans and spyware steal UPI credentials, banking passwords, and device access silently.
Also known as: fake ChatGPT app India, fake DeepSeek installer malware, fake Gemini app fraud, fake Claude download malware India, AI app malware India
Already happened to you? Do this in the next few minutes
Call 1930 now- 1 Call 1930 — the national cyber-crime helpline — right now. The sooner you report, the better the chance of freezing the money before it moves.
- 2 Call your bank to freeze the account and block the card immediately. Use the number printed on your card, never a number from the message or caller.
- 3 File a report at cybercrime.gov.in and keep every message, screenshot, and transaction ID.
- ! If you installed any "support", "server", "refund", or remote-access app at their request (AnyDesk, TeamViewer, Quick Support, etc.): disconnect the internet now, then run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
What to do right now
- 1 Access ChatGPT only at chat.openai.com, Claude at claude.ai, Gemini at gemini.google.com — never download these from sponsored ads or third-party links
- 2 If you installed a fake AI app: immediately revoke its SMS, accessibility, and notification permissions in Settings, then uninstall it
- 3 Change your UPI PIN, net-banking password, and mobile-banking PIN from a different, clean device; treat all saved passwords as compromised
- 4 Call your bank's 24-hour helpline to freeze transactions if you notice any unexplained debits or suspect your OTPs are being forwarded
- 5 Run a reputable mobile security scanner (e.g. Google Play Protect) to detect and remove the malware
- 6 If you installed any 'support' or 'server' or 'refund app' or remote-access app at the scammer's request (AnyDesk, TeamViewer, Quick Support, etc.), run free SeraphSecure (https://www.seraphsecure.com) to detect and remove it.
- 7 Report at https://cybercrime.gov.in or call 1930 (national cyber helpline).
Was remote-access software installed?
If a scammer asked you to install AnyDesk, TeamViewer, Quick Support, or any remote-access app, your device may still be compromised.
Run SeraphSecure to detect and remove it →Red flags
- ⚠ A social media ad, sponsored search result, or messaging-app link offers a free ChatGPT, Gemini, DeepSeek, or Claude subscription or desktop installer — real AI tools are accessed only through their official websites, never via sponsored links
- ⚠ The installer or app asks for SMS, banking, or accessibility permissions — a genuine AI chat tool needs none of these
- ⚠ You are prompted to 'sign in with Facebook' or enter your bank/UPI credentials inside a newly downloaded app — legitimate AI services use their own login flows
- ⚠ After installing, your UPI app behaves oddly, banking OTPs arrive for transactions you did not initiate, or funds disappear without any action on your part
- ⚠ The 'free ChatGPT subscription' offer arrived via WhatsApp, Telegram, or a pop-up ad — this is how malware distributors reach victims
Sources
- Kaspersky Press Release — 92,000+ malware attacks disguised as AI services detected Jan–May 2026; India SMBs surge 6x
- IT Voice — Kaspersky: Malware attacks on India SMBs disguised as AI services surged by more than 6x in 2026
- Business Standard — Fake ChatGPT, Claude, Gemini apps now used as bait for malware attacks (August 24, 2026)
- Amar Ujala — Fake ChatGPT/Gemini/Claude app fraud warning: bank account can be emptied (August 25, 2026)
- Kaspersky Securelist — SMB threat report 2026: fake AI tools drive attacks