Custom ChatGPTs push ClickFix attacks to deploy RAT malware

Custom ChatGPTs push ClickFix attacks: what actually changed

Custom ChatGPTs push ClickFix attacks to deploy RAT malware By Bill Toulas September 29, 2026 04:59 PM 0 Custom variants of OpenAI’s ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. The threat actor is abusing the legitimate feature in the AI platform that lets users create a version of ChatGPT tailored for a specific task that combines instructions, extra knowledge, and skills.

OpenAI hosts these custom GPTs, which can be published for others to install and use. The malicious campaign was identified by Huntress, a managed detection and response (MDR) company, whose researchers say it affected dozens of users.

Custom ChatGPTs push ClickFix attacks: how it works

The threat actor named the malicious GPT model 'Plus 5.6' and configured it to direct users to an alleged backup site hosted on Google Sites. See the full write-up from BleepingComputer via the source link for quotes and complete context.

Custom ChatGPTs push ClickFix attacks: why it matters now

The malicious custom GPTSource: Huntress However, the page shows a fake Cloudflare check and instructs visitors to run a PowerShell command, which deploys the infection chain. Huntress researchers observed similar attacks in the past, which used deceptive ChatGPT conversations to launch ClickFix ruses and compromise targets, but using custom GPTs is a novel approach.

Custom ChatGPTs push ClickFix attacks: who is affected

In both attacks, the malicious instructions are hosted on the legitimate ChatGPT.com domain, lending legitimacy to the operation and increasing the chances the victim will follow the instructions. If executed locally, the provided PowerShell command installs a malicious MSI that launches a legitimate, signed application and a modified DLL loading the malware.

Custom ChatGPTs push ClickFix attacks: what to watch

The payload used in this campaign is a remote access trojan (RAT) with capabilities for remote desktop access, audio and camera capture, file searches, host reconnaissance, and running additional payloads. See the full write-up from BleepingComputer via the source link for quotes and complete context.