ChatGPhish: The Page Is the Payload

By appending a payload to any web page summarized by ChatGPT, an attacker can leak IP, User-Agent, and launch phishing attacks using live links and images inside the assistant UI. This browser-based prompt injection raises the bar for phishing and tracking, bypassing traditional defenses.