Hackers Use ChatGPT Custom GPTs in ClickFix Attacks
Huntress details a ClickFix campaign using malicious ChatGPT Custom GPTs to push PowerShell installers and a RAT; at least 40 users infected.
A threat actor created ChatGPT Custom GPTs, including one titled 'Plus 5.6', that responded to prompts with Google Sites links leading to fake CAPTCHA ClickFix pages instructing victims to run PowerShell, per Huntress. The commands downloaded a malicious MSI that abused a Canon-signed application for DLL sideloading, persisted via a Run key and a scheduled task, and delivered a RAT hidden in an obfuscated audio file archive (315 folders, 806 files). The RAT fingerprints systems and reaches command-and-control over DNS-over-HTTPS via Cloudflare, Google, and Quad9. At least 40 users were infected; OpenAI removed one Custom GPT on September 25 and a second appeared September 27, with the variant switching to a Stardock executable and a NuGet-packaged loader.
- Custom GPTs reached victims via sponsored Google search results for ChatGPT
- Victims ran PowerShell that downloaded MSI loaders via DLL sideloading and scheduled tasks
- Final payload is a RAT using DNS-over-HTTPS C2 through Cloudflare, Google, Quad9
- OpenAI took down one Custom GPT; a replacement appeared two days later
- At least 40 infections, two tied directly to Custom GPT instances
Indicators of compromiseauto-extracted · verify before use · export allAll →
| Type | Indicator | Context |
|---|---|---|
| domain | chatgpt.com | include specific instructions and tools. They are hosted on ChatGPT.com, and their pages feature their custom names at the top, alo |
Full article504 words · extracted from securityweek.com · click to collapse
A newly discovered ClickFix campaign is relying on ChatGPT Custom GPTs to impersonate legitimate products and lure victims into executing malicious code on their machines.
Custom GPTs are personalized versions of ChatGPT that may include specific instructions and tools. They are hosted on ChatGPT.com, and their pages feature their custom names at the top, along with the builder’s profile.
As part of the malicious campaign, a threat actor programmed two Custom GPTs to respond to users’ prompts with a Google Sites link leading to a ClickFix page, cybersecurity firm Huntress reports.
On this page, visitors were instructed to execute PowerShell commands that downloaded a malicious MSI file as part of a multi-stage infection chain.
According to Huntress, at least 40 users have been infected as part of the campaign, and at least two of the incidents are connected to a Custom GPT instance. OpenAI took down the Custom GPT on September 25, but a second one was discovered on September 27.
“Threat actors are finding success in this specific abuse of Custom GPTs for social engineering and are continuing to rely on this technique,” Huntress notes.
Advertisement. Scroll to continue reading.
The victims accessed the Custom GPT after searching for ChatGPT on Google and being served the page as a sponsored result at the top of the search results.
To trick the victims, the attackers titled the Custom GPT “Plus 5.6” and claimed it was from a “community builder”. The user received a fake notice claiming limited availability through the primary domain and requesting an upgrade or use of the service through a backup domain.
Hosted on a Google Sites page, the fake backup domain would serve a Cloudflare CAPTCHA check, part of the ClickFix attack, instructing the victim to execute a PowerShell command meant to download and execute a malicious installer.
The first Custom GPT served an installer that abused a legitimate Canon-signed application for DLL sideloading and set up persistence through a User Run key and a scheduled task posing as “Canon Configuration Reader”.
The infection chain continued with a loader concealed as an audio file, designed to bypass security protections, perform system checks, and display a fake loading window.
At the next stage, malicious code was loaded from a heavily obfuscated audio file containing a custom archive with 315 folders and 806 files inside, including the final payload, a RAT capable of fetching, processing, and executing various types of payloads.
The malware fingerprinted the infected system and connected to its command-and-control (C&C) server using DNS-over-HTTPS through Cloudflare, Google, and Quad9.
While the final payload served by the second Custom GPT remained unchanged, the threat actor switched to a Stardock executable and a patched Stardock DLL for infection, and placed the loader in a Microsoft NuGet package instead of an audio file.
Related: Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft
Related: New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining
Related: RatHat Android Trojan Uses AI for Automation
Related: US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware