Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware
Huntress uncovered a campaign abusing ChatGPT CustomGPT 'Plus 5.6' with ClickFix to sideload a RAT via a Canon-signed app, infecting at least 40 users.
Huntress detailed a malware campaign active since September 2026 that abuses ChatGPT's CustomGPT feature: a fake GPT named 'Plus 5.6' was promoted through sponsored Google search results and directed victims to a 'backup domain' hosting a ClickFix fake CAPTCHA. Victims who pasted the verification command ran a malicious MSI that used a legitimate Canon-signed application to sideload a remote access trojan with persistence. The RAT can capture microphone and camera audio/video, exfiltrate data to attacker C2 servers, and deliver additional payloads. At least 40 infections were recorded; OpenAI took down the CustomGPT on September 25, but researchers have already found a replacement GPT linked to the same campaign.
- CustomGPT 'Plus 5.6' impersonated ChatGPT via sponsored Google search results.
- ClickFix fake Cloudflare CAPTCHA tricked victims into pasting attacker-supplied commands, bypassing endpoint protections.
- Canon-signed application sideloaded a RAT enabling microphone, camera capture, and data exfiltration.
- At least 40 infections; OpenAI removed the GPT Sept 25 but a successor has already appeared.
Full article431 words · extracted from infosecurity-magazine.com · click to collapse
Cybercriminals have combined a legitimate function of ChatGPT with ClickFix attacks to infect victims with malware, researcher have found.
Uncovered by cybersecurity firm Huntress, the malware campaign, which has been active since September, abuses the CustomGPT feature of ChatGPT. CustomGPTs are personalized versions of ChatGPT which users can build to follow specific instructions and workflows.
As detailed in a blog post by Huntress, the attackers manipulated ChatGPT CustomGPTs to impersonate legitimate product offerings and even to interact with victims, to direct them to sites which deliver malware.
The attackers developed a CustomGPT called Plus 5.6 which is designed to look like the real ChatGPT. According to Huntress, users are directed to Plus 5.6 via sponsored search results after looking for ‘chatgpt’ on Google.
If a user visits the site, the CustomGPT delivers a “Service Availability Notice” which claims there is limited availability for the model on the “primary domain” but directs them to a link for a “backup domain”.
ClickFix Attack Disguised as CAPTCHA
This backup domain initially looks like a CloudFlare CAPTCHA check, which asks the user to paste a command to ‘verify’ themselves.
This is the ClickFix attack, a popular attack technique among cybercriminals, which uses social engineering to trick the victim into running attacker-supplied commands on their own machine. Because the victim themselves has run the command, the ClickFix attack often bypasses any security protections on the machine.
“Every step of the attack also borrows a brand people already trust, from ChatGPT and Google to Cloudflare and even Canon software. The takeaway is simple. No legitimate website will ever ask you to copy and paste a command to prove you’re human,” the company said.
This link directs the user to a malicious Microsoft Software Installer (MSI) which is used to deploy a legitimate Canon-signed application the attackers have used to sideload malicious code, this ultimately establishes persistence on the machine and delivers remote access trojan (RAT) malware.
This RAT can be used to monitor the infected system, including the ability to capture audio and video from microphones and cameras, as well exfiltrate data to a command and control server operated by the attackers. The RAT can also be used to deliver additional malware and malicious payloads to the machine.
According to analysis by Huntress, there have been at least 40 infections related to the campaign. The researchers reported the Plus 5.6 CustomGPT to Open AI, which was taken down as of September 25.
However, researchers have already identified a new CustomGPT linked to the same campaign and Huntress has warned ChatGPT users to be cautious.