CTI · reviewed · 2026-09-30
Custom ChatGPTs push ClickFix attacks to deploy RAT malware
Actors
—
Malware / tools
—
Campaigns
Custom GPT ClickFix
CVEs
—
Victim sectors
technology
Geography
—
MITRE ATT&CK
Indicators
Observables tied to this case, from the curated feed. raw sidecar
Detections
Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.
Sigma raw
title: Custom GPT ClickFix Chain - PowerShell Silently Installing RAT MSI
id: e0c9484f-d1da-4ac0-9e7d-e554895516ad
status: experimental
description: 'Detects the ClickFix delivery chain used through malicious ChatGPT Custom GPTs (Huntress, September 2026): a command pasted from the fake service-availability notice runs PowerShell that fetches a decimal-IP stager (1614733393 = 96.62.224.81) and silently installs the RAT MSI (ISOSimple.msi, IconEdit2Turb.msi, UltraFreeISOCreateWizardSolution.msi) via msiexec /qn /norestart.'
references:
- https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
- https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/
author: Tia N. List
date: 2026-09-30
tags:
- attack.execution
- attack.persistence
- attack.stealth
- attack.t1204
- attack.t1059
- attack.t1086
- attack.t1060
- attack.t1053
- attack.t1036
logsource:
category: process_creation
product: windows
detection:
selection_psi_silent_msi:
ParentImage|endswith: '\powershell.exe'
Image|endswith: '\msiexec.exe'
CommandLine|contains|all:
- '/qn'
- '/norestart'
selection_named_msi:
Image|endswith: '\msiexec.exe'
CommandLine|contains:
- 'ISOSimple.msi'
- 'IconEdit2Turb.msi'
- 'UltraFreeISOCreateWizardSolution.msi'
selection_decimal_stager:
CommandLine|contains: '1614733393'
condition: selection_psi_silent_msi or selection_named_msi or selection_decimal_stager
falsepositives:
- Software deployment tooling that launches msiexec silently from PowerShell
- Unrelated installers whose command lines coincidentally contain the stager decimal string
level: high