Attackers abuse ChatGPT Custom GPT to deliver RAT via ClickFix

Attackers used ChatGPT's Custom GPT feature to publish a malicious GPT disguised as an upgraded version of ChatGPT, promoted through sponsored Google search results, leading victims into a ClickFix social engineering chain and ultimately deploying a remote access trojan (RAT). Huntress discovered and disclosed this campaign, tracing at least 40 related incidents to the same Google Sites page, with two confirmed to originate directly from interactions with a Custom GPT named Plus 5.6. The infection chain consists of eight stages, involving DLL side-loading of legitimately signed executables from Canon and Stardock, payloads hidden in WAV audio files and NuGet package data, and a homemade encrypted container for staging persistence scripts. OpenAI removed the first malicious GPT on September 25, 2026, after Huntress's report, but the operators launched a replacement just two days later on September 27.