Reported by 4 outlets

Custom ChatGPTs push ClickFix attacks to deploy RAT malware

hot0.4

Why this score

Breadth: 2.00 / 2.0 · 4 sources
Authority: 1.80 / 2.0 · best outlet weight
Severity: 0.70 / 5.0 · CVSS + content signals
Velocity: 0.00 / 2.0 · updates in 48h
Pickup speed: 0.08 / 0.6 · time to second source
Recency: × 0.00 temporal multiplier
Community: + 0.40 / 1.5 · reddit signal
Score: 0.4 / 10 = base × recency + community

bleepingcomputer.comhuntress.comfawkes.rockstugatech.com.pt desk first seen 14d ago

Desk analysis

Custom ChatGPT variants promoted in sponsored Google results are delivering malware via ClickFix attacks. A threat actor named a malicious model "Plus 5.6" and configured it to send users to an alleged backup site hosted on Google Sites. The site presents a fake Cloudflare check and instructs visitors to run a PowerShell command that installs a malicious MSI launching a signed application. Huntress identified the campaign, affecting dozens of users. OpenAI plans to retire custom GPTs on December 11. The malicious instructions are hosted on ChatGPT.com, lending legitimacy to the operation. This is a novel evolution from earlier deceptive ChatGPT conversation attacks.

This matters because it abuses a legitimate platform feature and sponsored advertising to reach victims with a trusted domain as part of the infection chain. Organizations should treat unexpected PowerShell prompts from any site, including those linked from AI platforms, as immediate indicators of compromise. The campaign's scale (dozens of users) and use of a signed MSI suggest an established actor.

Watch for OpenAI's December 11 retirement of custom GPTs, which could either disrupt the campaign or push actors to new platforms. Monitor for additional malicious custom GPT names or variations beyond "Plus 5.6".

Timeline

original reporting

Custom ChatGPTs push ClickFix attacks to deploy RAT malware

bleepingcomputer.com · 14d ago · September 29th, 2026

Custom variants of OpenAI’s ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. The threat actor is abusing the legitimate feature in the AI platform that lets users create a version of ChatGPT tailored for a specific task that combines instructions, extra knowledge, and skills. OpenAI hosts these custom GPTs, which can be published for others to install and use. The company plans to retire custom GPTs on December 11. The malicious campaign was identified by Huntress, a managed detection and response (MDR) company, whose researchers say it affected dozens of users. The threat actor named the malicious GPT model 'Plus 5.6' and configured it to direct users to an alleged backup site hosted on Google Sites. The malicious custom GPT Source: Huntress However, the page shows a fake Cloudflare check and instructs visitors to run a PowerShell command, which deploys the infection chain. Huntress researchers observed similar attacks in the past, which used deceptive ChatGPT conversations to launch ClickFix ruses and compromise targets, but using custom GPTs is a novel approach. In both attacks, the malicious instructions are hosted on the legitimate ChatGPT.com domain, lending legitimacy to the operation and increasing the chances the victim will follow the instructions. If executed locally, the provided PowerShell command installs a malicious MSI that launches a legitimate, signed application an
update from huntress.com

AMOS Stealer Exploits AI Trust: Malware Delivered Through ChatGPT and Grok

huntress.com · 309d ago · December 9th, 2025

Huntress reported on December 9, 2025 an AMOS incident triaged December 5, 2025 in which a Google search for "Clear disk space on macOS" surfaced poisoned ChatGPT and Grok conversations whose commands harvested the user's password through a fake prompt validated with dscl -authonly, then escalated to root and persisted via a one-second watchdog loop. Huntress stated it was the first time it observed the family using AI-formatted troubleshooting content as the initial lure.
update from bleepingcomputer.com

Google ads for shared ChatGPT, Grok guides push macOS infostealer malware

bleepingcomputer.com · 307d ago · December 10th, 2025

BleepingComputer covered the direct precursor on December 10, 2025: Google ads and SEO poisoning sent macOS users to shared ChatGPT and Grok conversations whose Terminal "cleanup" commands installed the AMOS infostealer with root privileges and a com.finder.helper.plist watchdog. The article establishes the AI-platform instruction-lure pattern that the custom GPT variant later carried over to Windows.
update from huntress.com

That 'Friendly' Prompt is ClickFix

huntress.com · 203d ago · March 25th, 2026

Huntress's earlier ClickFix explainer, published March 25, 2026, sets the baseline this campaign builds on: ClickFix accounted for over 50% of malware loader activity in the Huntress 2026 Cyber Threat Report. The post argues that everyday verify-you-are-human rituals condition users to paste commands on request, which is the exact reflex the ChatGPT-hosted ClickFix pages exploit.
update from huntress.com

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

huntress.com · 16d ago · September 28th, 2026

Huntress published the original disclosure of this campaign on September 28, 2026, one day before BleepingComputer's coverage, credited to Mark O'Halloran and Jonathan Semon. It documents two attacker-created custom GPTs titled "Plus 5.6" (g-6ab595ad6554819181b686d4876efb80 and g-6ab6ba039440819185ed491740b11cf8), the ClickFix lure at sites.google.com/view/antibot172881, and an eight-stage chain from a decimal-IP stager host (1614733393, resolving to 96.62.224.81) through ISOSimple.msi and Canon-signed COTFileReadApp.exe sideloading to a RAT in a custom encrypted archive. The Huntress SOC responded to at least 40 related incidents with two confirmed custom GPT infections, published full IoCs including 45.140.205.28 and sample SHA256s, and described a second wave using a Stardock-signed host (DeElevate64.exe, IconEdit2Turb.msi, "Stardock DeElevation Tool" persistence).
update from www.bleepingcomputer.com

Custom ChatGPTs push ClickFix attacks to deploy RAT malware https:// bleepingcomputer.com/news/security/ custom-chatgpts-push-clickfix-attac

www.bleepingcomputer.com · 14d ago · September 29th, 2026

Custom ChatGPTs push ClickFix attacks to deploy RAT malware https:// bleepingcomputer.com/news/security/ custom-chatgpts-push-clickfix-attac

via X https://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/
update from www.bleepingcomputer.com

Custom GPTs are being used to spread ClickFix attacks that lead to RAT installation

www.bleepingcomputer.com · 14d ago · September 29th, 2026

Custom GPTs are being used to spread ClickFix attacks that lead to RAT installation. The conversational interface becomes a ...
update from fawkes.rocks

Malicious ChatGPT Custom GPT pushes RAT via ClickFix https:// fawkes.rocks/2026/09/30/malici ous-chatgpt-custom-gpt-pushes-rat-via-clickfix/

fawkes.rocks · 14d ago · September 29th, 2026

Malicious ChatGPT Custom GPT pushes RAT via ClickFix https:// fawkes.rocks/2026/09/30/malici ous-chatgpt-custom-gpt-pushes-rat-via-clickfix/

via Mastodon https://fawkes.rocks/2026/09/30/malicious-chatgpt-custom-gpt-pushes-rat-via-clickfix/
update from tugatech.com.pt

Cyberattacks are using custom ChatGPT models to redirect users to malicious pages, promoted through

tugatech.com.pt · 14d ago · September 29th, 2026

Cyberattacks are using custom ChatGPT models to redirect users to malicious pages, promoted through

via Mastodon https://tugatech.com.pt/t91946-gpts-personalizados-do-chatgpt-sao-usados-em-ataques-clickfix-para-espalhar-malware