Malicious Custom GPT on chatgpt.com lures users into installing a RAT

Malware peddlers are using sponsored Google results to push a malicious ChatGPT Custom GPT named “Plus 5.6,” created to lead users to a fake Cloudflare CAPTCHA check and, ultimately, make them download and run a remote access trojan (RAT).

“The campaign has impacted dozens of users: the Huntress SOC has responded to at least 40 incidents stemming from the specific Google Sites domain involved in this attack, and confirmed that two of these incidents came through a Custom GPT instance,” Huntress researchers warned.

How the attack unfolds

This malware delivery campaign was spotted in late September. Links to the Custom GPTs appeared in sponsored Google Search results for users searching for “chatgpt”.

Those who followed the links landed on the malicious Custom GPT pages, created through a ChatGPT feature and located on the legitimate chatgpt.com website.

When users tried to use the attacker-created Custom GPT, it told them that the service was unavailable and directed them to a “Backup Domain” (on a Google Sites page):

The Custom GPT points users to the fake CAPTCHA check (Source: Huntress)

“This Google Sites page presents as a CloudFlare CAPTCHA check and delivers a ClickFix attack, telling users to copy-and-paste a command into their Terminal,” Huntress researchers explained.

Users who ran the command triggered a chain that ended with a full-featured RAT being sideloaded through legitimately signed Canon (and, in a later wave, Stardock) executables.

After the researchers observed and reported the first malicious Custom GPT, OpenAI removed it. It didn’t take long, though, for the crooks to create another one and push it to Google Search users. And while the infection chain was slightly different the second time around, the goal and the delivered RAT were the same.

This second Custom GPT is still online, though it doesn’t point to the malicious ClickFix lure anymore (we checked). According to the researchers, however, the attackers are already working on a new installer.

“These campaigns often stay live for just hours or days before the provider takes the content down, but even in that short span, they can draw considerable attention,” the researchers noted.

What users and organizations can do

The advice for end users is simple: no legitimate website, CAPTCHA, or “fix” will ever ask you to copy something and paste it into the Run dialog, Terminal, PowerShell, or a command prompt. If a page asks for that, it’s an attack.

Users should also be wary of sponsored search results and not trust a page just because of where it’s hosted.

For organizations, the goal is layered defense. They should train users so that fewer of them fall for the ClickFix trick, make it harder to act on the instructions (e.g., by restricting the Win+R Run dialog for standard users, locking down PowerShell, etc.), and make sure their security teams can detect the attack if those protections can’t be implemented.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!