Reported by 2 outlets
Hackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RAT
Why this score
- Breadth
- 1.00 / 2.0 · 2 sources
- Authority
- 1.20 / 2.0 · best outlet weight
- Severity
- 0.50 / 5.0 · CVSS + content signals
- Velocity
- 0.00 / 2.0 · updates in 48h
- Pickup speed
- 0.56 / 0.6 · time to second source
- Recency
- × 0.00 temporal multiplier
- Community
- + 0.00 / 1.5 · reddit signal
- Score
- 0.0 / 10 = base × recency + community
Timeline
-
original reporting
Hackers Abuse ChatGPT Shared Links and Fake Cloudflare CAPTCHA to Deploy NetSupport RAT
cyberpress.org · 42d ago · September 1st, 2026
Cybercriminals are abusing legitimate ChatGPT shared-conversation pages to deliver NetSupport RAT through a multi-stage ClickFix campaign. The attack combines trusted ChatGPT content, fake OpenAI and Cloudflare branding, clipboard-based PowerShell execution, and an encrypted payload hidden inside an MP4 file. The malicious chain does not compromise the chatgpt.com domain itself. Instead, attackers use a legitimate shared ChatGPT page to display deceptive instructions. The page tells visitors that ChatGPT is experiencing “high traffic” and directs them to an alleged backup website, openai-backup.one . The external website impersonates OpenAI, Cloudflare, and Google. It presents a fake human-verification page designed to convince Windows users that they must complete a CAPTCHA-like process. However, the verification actually places a malicious PowerShell command into the clipboard. The command retrieves code from brmconfig.com and executes it through PowerShell. This represents a classic ClickFix technique, where victims are manipulated into manually executing attacker-supplied commands under the belief that they are completing a security check. ChatGPT Links Spread NetSupport RAT The initial PowerShell stage retrieves and evaluates a remote script from brmconfig.com . The loader hides its console window, performs system checks, and launches additional PowerShell code using hidden-window and execution-policy-bypass options. The second stage collects detailed information about t
-
update from gbhackers.com
Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT
gbhackers.com · 42d ago · September 1st, 2026
Threat actors are abusing legitimate ChatGPT shared-conversation URLs to host social-engineering lures that steer victims into a ClickFix-style infection chain, ultimately delivering a NetSupport remote-access tool (RAT). The observed chain begins with a legitimate ChatGPT shared link, chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8, which displays a fabricated availability notice claiming: “We are experiencing high traffic now. Continue on our backup […] The post Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT appeared first on GBHackers Security | #1 Globally Trusted Cyber Security News Platform .