Threat actors leveraged personalized ChatGPT Custom GPTs to impersonate legitimate software and lure victims into executing PowerShell commands that download malicious MSI installers. The infection chain involved abusing a legitimate Canon-signed application for DLL sideloading, establishing persistence via scheduled tasks and registry keys, and deploying a loader disguised as an audio file or a Microsoft NuGet package. The final payload is a remote access Trojan (RAT) capable of executing various payloads and communicating with its command-and-control server over DNS-over-HTTPS via Cloudflare, Google, and Quad9. The malicious Custom GPTs appeared as sponsored Google search results and used social engineering tactics such as fake upgrade notices and CAPTCHA challenges to convince victims to run the commands. OpenAI removed some malicious Custom GPTs, but attackers continue to create new instances.

The campaign results in the compromise of victim machines through multi-stage malware infections, enabling attackers to execute arbitrary payloads remotely. The use of DLL sideloading and obfuscated loaders helps evade detection and maintain persistence. The RAT's ability to fingerprint systems and use encrypted DNS-over-HTTPS communication increases stealth and complicates network-based detection. At least 40 infections have been confirmed, indicating active targeting and successful exploitation of users.

OpenAI has taken down identified malicious Custom GPTs, but new instances continue to appear, so vigilance is required. Users should avoid executing PowerShell commands from untrusted sources, especially those prompted by unsolicited or suspicious ChatGPT Custom GPTs or websites. Organizations should educate users about the risks of social engineering via AI tools and monitor for unusual PowerShell activity. Since this attack relies on social engineering and user execution, user awareness and cautious behavior are primary mitigations. No official patch applies as this is a social engineering and malware delivery technique rather than a software vulnerability.