Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Threat actors are abusing ChatGPT Custom GPTs and Google Sites to deliver a remote access trojan (RAT) via a multi-stage attack. The campaign uses sponsored Google search results to lure victims to attacker-created Custom GPTs impersonating legitimate ChatGPT models. Victims are redirected to a malicious Google Sites page with a fake CloudFlare CAPTCHA that deploys a ClickFix lure, tricking users into running PowerShell commands. This triggers an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through signed Canon or Stardock executables. The RAT establishes dual persistence and includes capabilities such as remote desktop access, credential theft from multiple browsers, file management, and payload deployment. At least 40 incidents have been investigated with two confirmed infections linked to this method.
AI Analysis
Technical Summary
Attackers exploit ChatGPT Custom GPTs and Google Sites to deliver a remote access trojan through a complex multi-stage infection chain. The attack begins with victims finding attacker-created Custom GPTs via sponsored Google search results, which impersonate legitimate ChatGPT models. Victims are then redirected to a malicious Google Sites page presenting a fake CloudFlare CAPTCHA that deploys a ClickFix lure, convincing users to execute PowerShell commands. This initiates an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through legitimately signed Canon or Stardock executables. The deployed RAT establishes dual persistence mechanisms and provides extensive capabilities including remote desktop control, credential harvesting from seventeen browsers, file management, and payload deployment. Huntress investigators have responded to at least 40 related incidents, confirming two infections directly linked to this Custom GPT-driven attack vector.
Potential Impact
The threat results in the deployment of a full-featured remote access trojan capable of remote desktop access, credential harvesting from multiple browsers, file management, and further payload deployment. The infection chain uses legitimate signed executables for DLL sideloading, increasing stealth and persistence. This can lead to significant compromise of victim systems, including data theft and unauthorized remote control.
Mitigation Recommendations
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should be aware of this attack vector involving ChatGPT Custom GPTs and Google Sites abuse. Users should be cautious of sponsored search results leading to unfamiliar GPTs and avoid executing unsolicited PowerShell commands. Monitoring for suspicious DLL sideloading and MSI installer activity may help detect infection attempts. Since this is a multi-stage social engineering attack, user education on phishing and social engineering risks is critical.
Indicators of Compromise
- hash: 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4
- hash: 6ab595ad6554819181b686d4876efb80
- hash: 6ab6ba039440819185ed491740b11cf8
- hash: 0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f
- hash: 14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335
- hash: 20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53
- hash: 278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48
- hash: 3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621
- hash: 54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31
- hash: 6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc
- hash: 91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2
- hash: 9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d
- hash: a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6
- hash: ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907
- hash: b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4
- hash: b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe
- hash: c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7
- hash: d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e
- hash: d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90
- hash: e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb
- hash: e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b
- hash: eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764
- ip: 96.62.224.81
Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
Description
Threat actors are abusing ChatGPT Custom GPTs and Google Sites to deliver a remote access trojan (RAT) via a multi-stage attack. The campaign uses sponsored Google search results to lure victims to attacker-created Custom GPTs impersonating legitimate ChatGPT models. Victims are redirected to a malicious Google Sites page with a fake CloudFlare CAPTCHA that deploys a ClickFix lure, tricking users into running PowerShell commands. This triggers an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through signed Canon or Stardock executables. The RAT establishes dual persistence and includes capabilities such as remote desktop access, credential theft from multiple browsers, file management, and payload deployment. At least 40 incidents have been investigated with two confirmed infections linked to this method.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Attackers exploit ChatGPT Custom GPTs and Google Sites to deliver a remote access trojan through a complex multi-stage infection chain. The attack begins with victims finding attacker-created Custom GPTs via sponsored Google search results, which impersonate legitimate ChatGPT models. Victims are then redirected to a malicious Google Sites page presenting a fake CloudFlare CAPTCHA that deploys a ClickFix lure, convincing users to execute PowerShell commands. This initiates an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through legitimately signed Canon or Stardock executables. The deployed RAT establishes dual persistence mechanisms and provides extensive capabilities including remote desktop control, credential harvesting from seventeen browsers, file management, and payload deployment. Huntress investigators have responded to at least 40 related incidents, confirming two infections directly linked to this Custom GPT-driven attack vector.
Potential Impact
The threat results in the deployment of a full-featured remote access trojan capable of remote desktop access, credential harvesting from multiple browsers, file management, and further payload deployment. The infection chain uses legitimate signed executables for DLL sideloading, increasing stealth and persistence. This can lead to significant compromise of victim systems, including data theft and unauthorized remote control.
Defensive Guidance
Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Defenders should be aware of this attack vector involving ChatGPT Custom GPTs and Google Sites abuse. Users should be cautious of sponsored search results leading to unfamiliar GPTs and avoid executing unsolicited PowerShell commands. Monitoring for suspicious DLL sideloading and MSI installer activity may help detect infection attempts. Since this is a multi-stage social engineering attack, user education on phishing and social engineering risks is critical.
Technical Details
- Author
- AlienVault
- Tlp
- white
- References
- ["https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat"]
- Pulse Id
- 6abb0c55e0fed2d6a1f7e51a
Indicators of Compromise
Hash
| Value | Description | Copy |
|---|---|---|
hash22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4 | — | |
hash6ab595ad6554819181b686d4876efb80 | — | |
hash6ab6ba039440819185ed491740b11cf8 | — | |
hash0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f | — | |
hash14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335 | — | |
hash20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53 | — | |
hash278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48 | — | |
hash3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621 | — | |
hash54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31 | — | |
hash6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc | — | |
hash91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2 | — | |
hash9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d | — | |
hasha27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6 | — | |
hashab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907 | — | |
hashb59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4 | — | |
hashb77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe | — | |
hashc4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7 | — | |
hashd3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e | — | |
hashd5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90 | — | |
hashe58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb | — | |
hashe614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b | — | |
hasheff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764 | — |
Ip
| Value | Description | Copy |
|---|---|---|
ip96.62.224.81 | — |
Threat ID: 6abc0fb4680226ef682b0a00
Added to database: 09/29/2026, 19:21:24 UTC
Last enriched: 09/29/2026, 19:36:15 UTC
Last updated: 09/29/2026, 19:36:15 UTC
Views: 3
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.