Executive Summary
A new attack campaign shows how criminals can turn a trusted AI platform into a delivery system for malware. Researchers at Huntress, in a report published September 28, 2026, found attackers using a Custom GPT hosted on the real ChatGPT website to send people to a fake “backup” page. That page tricked them into running a command that installed a remote access trojan (RAT). Huntress investigated at least 40 related incidents, two of them confirmed to have started with a Custom GPT. This post explains how the attack works, what a RAT can do to your business, and the practical steps your team can take now.
Introduction
Most of us have learned to be careful with strange emails. Fewer of us have learned to be careful with a chat window on a website we trust. That is the gap this campaign exploits.
Custom GPTs let anyone build a personalized version of ChatGPT with its own instructions and tools. They live on the genuine ChatGPT domain, so a page built by an attacker looks like it belongs there. Huntress has also seen attackers abuse shared AI conversations and malicious Claude Artifacts in earlier campaigns. The common thread is that the attacker borrows the reputation of a platform people already trust.
| Item | Detail |
|---|---|
| Threat type | Malvertising, social engineering (ClickFix), remote access trojan |
| Reported by | Huntress researchers, published September 28, 2026 |
| Entry point | A sponsored Google result for searches like “chatgpt,” leading to a Custom GPT |
| Lure name | A Custom GPT titled “Plus 5.6,” designed to look like a new ChatGPT model |
| Scale | At least 40 incidents tied to the same Google Sites domain; two confirmed via Custom GPT |
| Takedown | The first Custom GPT was removed September 25; a replacement appeared September 27 |
| Platform | Windows |
How the Attack Works, Step by Step
Step 1: The paid ad. An employee searches Google for “chatgpt” and clicks a sponsored result at the top of the page. Paying for the ad puts the link above the real search results.
Step 2: The Custom GPT page. The link opens a page on the genuine ChatGPT domain. The only hint is a small “community builder” label under the title, which most people would not recognize as a warning sign.
Step 3: The “Service Availability Notice.” Whatever the visitor types, the Custom GPT gives the same answer: the service has limited availability, and to continue you must upgrade to Plus or use a “backup domain.”
Step 4: The ClickFix page. The backup link opens a Google Sites page that imitates a Cloudflare security check. It tells the visitor to copy and paste a command to “verify” themselves. This technique is called ClickFix, and the command runs PowerShell on the victim’s own computer.
Step 5: The silent installation. PowerShell downloads a heavily obfuscated script, which silently installs a malicious MSI package. The script uses a number instead of a normal web address to avoid filters that look for standard IP formats.
Step 6: The disguise. The installer places a legitimately signed Canon application on the computer and uses it to load malicious code (a technique called DLL sideloading). Because the host program is genuinely signed, it draws less suspicion from security tools. The package is labeled as a printer configuration tool and hides itself from the list of installed programs.
Step 7: The RAT. After several more hidden stages, the attackers install a remote access trojan that can take over the computer. Two persistence mechanisms, a Run key and a scheduled task, both named “Canon Configuration Reader,” keep it alive across restarts.
⚠ Red-Flag Callout: Any page that tells you to copy and paste a command to prove you’re human is an attack. Real CAPTCHA checks never ask you to open PowerShell or Terminal.
Sample: What the Lure Looks Like
This is a paraphrased, illustrative example, not the exact attacker text.
Custom GPT reply (any question you type):
“Service Availability Notice: We are experiencing limited availability on our primary domain. To continue, please upgrade to Plus or continue through our backup domain: [link]”
Fake verification page:
“Verify you are human: press Windows + R, paste the command, and press Enter.”
Both messages are designed to feel routine. Neither would be alarming to someone in a hurry.
What a RAT Can Do to Your Business
According to Huntress’s analysis, the final payload is a full-featured remote access trojan. It can:
- Open remote desktop sessions and broadcast the victim’s screen
- Capture the camera, microphone, and system audio
- Search file contents across the whole computer
- Identify and launch any of 17 browsers
- Download and run follow-on malware in many formats
- Collect details about installed antivirus, Microsoft Defender status, domain and network information, and installed software
It also hides its command-and-control lookups inside encrypted DNS-over-HTTPS traffic to well-known resolvers, which keeps them out of ordinary local DNS logs. On a business computer, this kind of access can lead to stolen credentials, exposed client files, and further attacks across the network.
Why Antivirus Alone Isn’t Enough
In at least one incident, Microsoft Defender quarantined the installer, but the installer had already run, and the persistence mechanisms kept the attack going anyway. Huntress also found that the attackers quickly adapted: after the first Custom GPT was removed, a new one appeared, and a second version of the malware swapped the Canon app for one signed by a different vendor. Researchers also found a third installer on the same server and expect more variations. Detection that depends on specific file or vendor names will miss the next costume.
Suggested MITRE ATTACK Mapping
(Please verify technique IDs before publishing.)
Employee Checklist
| Tactic | Technique |
|---|---|
| Resource Development | T1583.008 – Malvertising |
| Execution | T1204.004 – Malicious Copy and Paste; T1059.001 – PowerShell; T1218.007 – Msiexec |
| Persistence | T1547.001 – Registry Run Keys; T1053.005 – Scheduled Task |
| Defense Evasion | T1574.002 – DLL Side-Loading; T1027 – Obfuscated Files or Information; T1562.001 – Impair Defenses (AMSI bypass); T1497 – Virtualization/Sandbox Evasion |
| Command and Control | T1219 – Remote Access Tools; T1572 – Protocol Tunneling (DoH) |
| Collection | T1113 – Screen Capture; T1123 – Audio Capture |
What Your Employees Should Do
- Don’t click sponsored results for AI tools. Type the official address yourself or use a bookmark.
- Check who built the page. A “community builder” label on a page that claims to be an official ChatGPT service or model is a warning.
- Never paste a command because a web page, chatbot, or pop-up tells you to.
- Be suspicious of “backup domains” and urgent upgrade demands.
- If you already ran a command, disconnect from the network, don’t restart, and call IT immediately. Reporting quickly matters more than embarrassment.
What Your IT Team Should Do
IT Action Checklist
- Restrict PowerShell for standard users where possible (constrained language mode, script-blocking policies, or application control).
- Remove local administrator rights and block silent MSI installs from user temp folders.
- Deploy EDR with behavior-based detection that watches process activity, not just file names.
- Hunt for these behaviors,which Huntress says carry across versions:
- PowerShell launching msiexec on a GUID-named MSI in the temp folder
- A signed application started from a fake product folder under the user’s LocalAppData\Programs directory
- A Run value and scheduled task sharing one name that return after deletion
- Check for known names, such as the “Canon Configuration Reader” and “Stardock DeElevation Tool” Run values and tasks, or an unsigned ceiinfolog.dll in the same folder as COTFileReadApp.exe.
- Clean up in the right order. If you find an infection, kill the running process first, then remove both the Run key and the scheduled task. Deleting one while the implant runs lets the script recreate it within minutes.
- Reset credentials used on the affected computer, and review other systems that user could reach.
- Block or monitor the indicators published in the Huntress report (shared with IT in defanged form), but don’t rely on them alone.
- Publish an AI acceptable-use policy that lists approved tools and how to reach them.
Why This Matters for Your Business
- Trust is the weapon. The page is on a real ChatGPT domain, so URL checks alone won’t stop it.
- It targets everyday behavior. Searching for an AI tool is a normal work habit.
- It’s built to come back. Persistence, version changes, and new Custom GPTs mean takedowns don’t end the threat.
How AvantGuard Can Help
Our Managed Services team can deploy endpoint detection, enforce script and admin controls, and run security awareness training that covers ClickFix and AI-themed lures. If a device is compromised, our Business Continuity, Data Protection, and Disaster Recovery services help keep your operations running and your data safe.
Stay secure and innovative.
www.avantguard.it | info@avantguard.it
Blog Source: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix | Huntress
