Attackers weaponise ChatGPT Custom GPTs to deliver RAT via eight-stage ClickFix chain
Attackers use ChatGPT Custom GPTs to deliver RAT via ClickFix chain.
Threat actors are leveraging ChatGPT's Custom GPT feature to distribute a sophisticated remote access trojan (RAT) through an eight-stage ClickFix attack chain. The campaign uses a fake GPT named 'Plus 5.6' hosted on OpenAI's domain, luring victims to a Google Sites page that prompts them to run a PowerShell command. This command initiates a multi-stage process involving obfuscated scripts, a malicious MSI, and a sideloaded DLL that ultimately deploys the RAT, which boasts extensive capabilities including remote desktop access and data exfiltration.
AI summary of the linked source. Not reviewed by an editor. How this works
Run OpenAI?
Get an email when a new story names OpenAI, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonThreat actors are abusing the trust users place in legitimate platforms — ChatGPT and Google Sites — to disguise a sophisticated malware delivery chain. By hosting a malicious Custom GPT on OpenAI's own domain, attackers exploit perceived legitimacy to trick victims into voluntarily executing a PowerShell command, bypassing technical controls through social engineering. The eight-stage chain uses obfuscation, DLL sideloading, and MSI abuse to evade detection and deploy a fully featured RAT. This attack demonstrates that platform trust is not a security guarantee, and that end-user awareness of command-execution prompts is a critical last line of defence.
What helps against this
How we list vendors
- Application allowlisting
Any program that reaches a computer can run, including ransomware and the remote-access tools attackers bring with them.
- Endpoint detection and response (EDR and XDR)
Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.
- Email security
Phishing, malware and invoice fraud are filtered out before they reach inboxes.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- url — https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat