CTI · corroborated · 2026-09-02

Hackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RAT

Full story & timeline

MITRE ATT&CK

• T1566 Phishing Initial Access
• T1059 Command and Scripting Interpreter Execution
• T1219 Remote Access Tools Command and Control

Indicators

Observables tied to this case, from the curated feed. raw sidecar

• brmconfig.com domain · expired
• openai-backup.one domain · expired

Detections

Detection content derived from this case analysis. Status: experimental — not validated against live telemetry.

Sigma raw

title: ChatGPT Shared Links Abuse - ClickFix PowerShell Execution
id: b8f4c2d5-03a7-4e9b-c6f2-4d8a0b3e9f5c
status: experimental
description: >
    Detects PowerShell execution patterns associated with the ChatGPT
    shared-links abuse campaign that deploys NetSupport RAT (cyberpress,
    2026). Attackers use legitimate chatgpt.com shared URLs to redirect
    victims to openai-backup.one, which presents a fake Cloudflare CAPTCHA
    that copies a PowerShell command to the clipboard. The loader fetches
    code from brmconfig.com and delivers an encrypted payload concealed
    inside an MP4 file.
references:
    - https://cyberpress.org
    - https://gbhackers.com
author: Tia N. List
date: 2026/09/02
tags:
    - attack.t1059
    - attack.t1566
logsource:
    category: process_creation
    product: windows
detection:
    selection_powershell:
        Image|endswith:
            - '\powershell.exe'
            - '\pwsh.exe'
    selection_clipboard_pattern:
        CommandLine|contains:
            - 'Set-Clipboard'
            - 'Get-Clipboard'
            - 'clip.exe'
    selection_download_pattern:
        CommandLine|contains:
            - 'brmconfig.com'
            - 'openai-backup'
            - 'Invoke-WebRequest'
            - 'DownloadString'
            - 'DownloadFile'
    condition: selection_powershell and (selection_clipboard_pattern or selection_download_pattern)
falsepositives:
    - Legitimate PowerShell scripts using clipboard or web download functions
level: high

References

• https://cyberpress.org
• https://gbhackers.com