Hackers Use ChatGPT Custom GPTs in ClickFix Attacks

Summary

A new ClickFix campaign is leveraging ChatGPT Custom GPTs to impersonate legitimate software and lure victims into executing malicious PowerShell commands. Threat actors created custom GPTs that, when prompted, directed users to a Google Sites page instructing them to run commands that downloaded a malicious MSI file. At least 40 users have been infected, with two incidents directly linked to a Custom GPT instance.

Full text

A newly discovered ClickFix campaign is relying on ChatGPT Custom GPTs to impersonate legitimate products and lure victims into executing malicious code on their machines. Custom GPTs are personalized versions of ChatGPT that may include specific instructions and tools. They are hosted on ChatGPT.com, and their pages feature their custom names at the top, along with the builder’s profile. As part of the malicious campaign, a threat actor programmed two Custom GPTs to respond to users’ prompts with a Google Sites link leading to a ClickFix page, cybersecurity firm Huntress reports. On this page, visitors were instructed to execute PowerShell commands that downloaded a malicious MSI file as part of a multi-stage infection chain. According to Huntress, at least 40 users have been infected as part of the campaign, and at least two of the incidents are connected to a Custom GPT instance. OpenAI took down the Custom GPT on September 25, but a second one was discovered on September 27. “Threat actors are finding success in this specific abuse of Custom GPTs for social engineering and are continuing to rely on this technique,” Huntress notes.Advertisement. Scroll to continue reading. The victims accessed the Custom GPT after searching for ChatGPT on Google and being served the page as a sponsored result at the top of the search results. To trick the victims, the attackers titled the Custom GPT “Plus 5.6” and claimed it was from a “community builder”. The user received a fake notice claiming limited availability through the primary domain and requesting an upgrade or use of the service through a backup domain. Hosted on a Google Sites page, the fake backup domain would serve a Cloudflare CAPTCHA check, part of the ClickFix attack, instructing the victim to execute a PowerShell command meant to download and execute a malicious installer. The first Custom GPT served an installer that abused a legitimate Canon-signed application for DLL sideloading and set up persistence through a User Run key and a scheduled task posing as “Canon Configuration Reader”. The infection chain continued with a loader concealed as an audio file, designed to bypass security protections, perform system checks, and display a fake loading window. At the next stage, malicious code was loaded from a heavily obfuscated audio file containing a custom archive with 315 folders and 806 files inside, including the final payload, a RAT capable of fetching, processing, and executing various types of payloads. The malware fingerprinted the infected system and connected to its command-and-control (C&C) server using DNS-over-HTTPS through Cloudflare, Google, and Quad9. While the final payload served by the second Custom GPT remained unchanged, the threat actor switched to a Stardock executable and a patched Stardock DLL for infection, and placed the loader in a Microsoft NuGet package instead of an audio file. Related: Daemon Tools Hackers’ NeedyMantis Malware Dissected by Microsoft Related: New x47.c Windows Botnet Weaponizes xAI Grok, AI API Draining Related: RatHat Android Trojan Uses AI for Automation Related: US, UK, Dutch Agencies Expose Iranian ‘Chosen Brick’ Surveillance Malware Written By Ionut Arghire Ionut Arghire is an international correspondent for SecurityWeek. Daily Briefing Newsletter Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights. More from Ionut Arghire Prison Sentence for Former US Soldier Who Hacked AT&T and VerizonDC Health Agency Exposes 400,000 Beneficiary RecordsGoogle Warns of ShinyHunters’ Fresh Oracle PeopleSoft CampaignKiteworks Urges Server Shutdown, Finds Advanced Forms VulnerabilityNew x47.c Windows Botnet Weaponizes xAI Grok, AI API DrainingKosovar Owner of Rydox Marketplace Pleads Guilty in US Court‘SalesBleed’ Flaws in Salesforce Agentforce Enabled Zero-Click Data ExfiltrationRoundcube Webmail Vulnerability in Attackers’ Crosshairs Latest News Reco Raises $55 Million for Agentic SecurityPentagon Personnel Agency Data Breach Impacts 3 Million PeopleRig Security Emerges From Stealth With $12M to Tackle Agentic AI Identity RisksFour Cyber Threats Harboring Big Plans for the FutureOpenAI Calls Off GPT-6.1 Astra Launch, Details Safety Cases for Frontier TrainingDutch Police Arrest Convicted Hacker in ShinyHunters InvestigationDaemon Tools Hackers’ NeedyMantis Malware Dissected by MicrosoftApple Patches Zero-Day Linked to ‘Extremely Sophisticated Attack’ Trending Daily Briefing NewsletterSubscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts. Webinar: Securing AI Agents, MCPs, and AI Automations October 7, 2026 Learn how to address potential risks and not restrict AI adoption in your organization. See what a centralized AI gateway is and how it works in practice. Register Virtual Event: Zero Trust & Identity Strategies Summit 2026 October 14, 2026 Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction. Register People on the MoveDoppel has named Joey Rachid as Chief Security Advisor and Field Chief Information Security Officer.Delinea has appointed Timothy Regan as Chief Financial Officer.Gwen Gann has become State Chief Information Security Officer for the State of Washington at WaTech.More People On The MoveExpert Insights Four Cyber Threats Harboring Big Plans for the Future - AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin) Begin at the End: How to Enable Agentic Remediation Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael) “We Think the Security Control Is Working” Is No Longer Good Enough Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar) This Key Will Self-Destruct: An Open Standard for Revocable API Keys Every leaked credential should be dead, or dying, within sixty seconds of being found. Here's a proposal to make that the default. (Matt Honea) What the Hugging Face Incident Teaches Security Leaders About AI Agent Access Security teams must treat autonomous agents as highly privileged identities. (Etay Maor) Flipboard Reddit Whatsapp Whatsapp Email

Indicators of Compromise

• malware — RAT
• malware — DLL sideloading
• malware — User Run key
• malware — scheduled task
• malware — loader
• malware — NuGet package

Entities