NewsPublished 29 Sep 2026

Hackers Use ChatGPT Custom GPTs in ClickFix Attacks

Source SecurityWeek

Description

A newly discovered ClickFix campaign abuses ChatGPT Custom GPTs to impersonate legitimate products and trick users into executing malicious PowerShell commands. The attackers created fake Custom GPT instances that directed victims to malicious Google Sites pages, leading to multi-stage malware infections involving DLL sideloading and a RAT payload. OpenAI has taken down some of these malicious Custom GPTs, but new instances continue to appear. At least 40 users have been infected, with the malware using advanced evasion techniques and DNS-over-HTTPS for command-and-control communication.

Impact

The campaign results in the compromise of victim machines through multi-stage malware infections, enabling attackers to execute arbitrary payloads remotely. The use of DLL sideloading and obfuscated loaders helps evade detection and maintain persistence. The RAT's ability to fingerprint systems and use encrypted DNS-over-HTTPS communication increases stealth and complicates network-based detection. At least 40 infections have been confirmed, indicating active targeting and successful exploitation of users.

Defensive guidance

OpenAI has taken down identified malicious Custom GPTs, but new instances continue to appear, so vigilance is required. Users should avoid executing PowerShell commands from untrusted sources, especially those prompted by unsolicited or suspicious ChatGPT Custom GPTs or websites. Organizations should educate users about the risks of social engineering via AI tools and monitor for unusual PowerShell activity. Since this attack relies on social engineering and user execution, user awareness and cautious behavior are primary mitigations.

Summary

Threat actors leveraged personalized ChatGPT Custom GPTs to impersonate legitimate software and lure victims into executing PowerShell commands that download malicious MSI installers. The infection chain involved abusing a legitimate Canon-signed application for DLL sideloading, establishing persistence via scheduled tasks and registry keys, and deploying a loader disguised as an audio file or a Microsoft NuGet package. The final payload is a remote access Trojan (RAT) capable of executing various payloads and communicating with its command-and-control server over DNS-over-HTTPS via Cloudflare, Google, and Quad9. The malicious Custom GPTs appeared as sponsored Google search results and used social engineering tactics such as fake upgrade notices and CAPTCHA challenges to convince victims to run the commands. OpenAI removed some malicious Custom GPTs, but attackers continue to create new instances.

References

securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/ (opens in a new tab)

Community reviews

Loading reviews…

Description

AI analysisMachine-generated, updated 29 Sep 2026, 13:17 UTC

References

Community reviews