[
 {
  "value": "45.140.205.28",
  "type": "ipv4",
  "first_seen": "2026-09-28",
  "last_seen": "2026-09-28",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware"
  ],
  "sources": [
   "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat"
  ],
  "reason": "Attacker host IP in ChatGPT custom GPT ClickFix RAT campaign (Huntress IoC)"
 },
 {
  "value": "96.62.224.81",
  "type": "ipv4",
  "first_seen": "2026-09-28",
  "last_seen": "2026-09-28",
  "status": "active",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware"
  ],
  "sources": [
   "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat"
  ],
  "reason": "Decimal-IP stager host in ChatGPT custom GPT ClickFix RAT campaign"
 },
 {
  "value": "com.finder.helper.plist",
  "type": "domain",
  "first_seen": "2025-12-10",
  "last_seen": "2025-12-10",
  "status": "expired",
  "confidence": "reported",
  "n_sources": 1,
  "stories": [
   "custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware"
  ],
  "sources": [
   "https://www.bleepingcomputer.com/news/security/google-ads-for-shared-chatgpt-grok-guides-push-macos-infostealer-malware/"
  ],
  "reason": "Watchdog LaunchAgent of AMOS infostealer ClickFix campaign"
 }
]