Threats Tagged 'canon sideloading'

Threat actors are abusing ChatGPT Custom GPTs and Google Sites to deliver a remote access trojan (RAT) via a multi-stage attack. The campaign uses sponsored Google search results to lure victims to attacker-created Custom GPTs impersonating legitimate ChatGPT models. Victims are redirected to a malicious Google Sites page with a fake CloudFlare CAPTCHA that deploys a ClickFix lure, tricking users into running PowerShell commands. This triggers an eight-stage infection chain involving obfuscated scripts, malicious MSI installers, and DLL sideloading through signed Canon or Stardock executables. The RAT establishes dual persistence and includes capabilities such as remote desktop access, credential theft from multiple browsers, file management, and payload deployment. At least 40 incidents have been investigated with two confirmed infections linked to this method.