Threat actors abuse ChatGPT custom GPTs to deliver RAT payloads via ClickFix-style attacks

Huntress documented a ClickFix campaign whose first stage runs on chatgpt.com itself. Two attacker-built Custom GPTs, both titled "Plus 5.6" and attributed to a "community builder", answered any prompt with a fake "Service Availability Notice" and a link to a Google Sites page (sites.google.com/view/antibot172881) dressed as a Cloudflare CAPTCHA. The victim who pastes the offered command runs PowerShell that pulls a stager from 1614733393, a decimal-IP spelling of 96.62.224[.]81, which silently installs a malicious MSI posing as "Advanced Printer Configuration Reader". The MSI sideloads patched Canon code, COTFileReadApp.exe loading a modified ceiinfolog.dll, then decodes a loader hidden inside a .wav file and unpacks a full-featured RAT from an encrypted custom archive, monitor.raw. Huntress counted at least 40 incidents tied to that Google Sites domain, two confirmed Custom GPT infections; OpenAI took the first GPT down on September 25 and a replacement was live by September 27.

The novelty is not the RAT, it is the address bar. Every early hop sits on infrastructure nobody blocks: the GPT URLs carried gad_source and gad_campaignid parameters, meaning victims arrived through paid Google ads placed above the organic results, then touched chatgpt.com and Google Sites, both reputation-gold. The first network indicator a filter can act on is the MSI fetch, which rides plain HTTP from a bare IP written in decimal, so dotted-IP URL rules never match. The payload is engineered to outlast an alert: a HKCU Run key rewritten every 150 seconds and a scheduled task every 875, AMSI bypass, ntdll unhooking, anti-VM checks, and C2 resolved over DNS-over-HTTPS through Cloudflare, Google and Quad9, so the "Gate" never appears in local DNS logs. Microsoft Defender did quarantine ISOSimple.msi as Trojan:Script/Wacatac.H!ml in one case, but only after the Run key and task had already taken over, which is the lesson: detection after installation is not containment here. Malicious DLLs were compiled 2026-09-24 22:46 UTC, one day before the first samples surfaced, and the delivery server already held a third installer on September 23. This is a maintained framework rotating costumes, not a one-off build.

Hunt by process lineage and persistence names, not hashes, because the V2 stager re-obfuscates per request. Alert on powershell.exe launching msiexec with /qn /norestart against a %TEMP% MSI named <32 hex characters>_ISOSimple.msi or IconEdit2Turb.msi; on COTFileReadApp.exe or the Stardock DeElevate64.exe running from %LOCALAPPDATA%\Programs\Advanced Printer Configuration Reader\ or %LOCALAPPDATA%\Programs\Stardock Smart DeElevation Tool\; on an unsigned ceiinfolog.dll, rdCore.dll, WPFLocalizeExtension.dll or WMPCL.dll beside the Canon host, and in V2 on a DeElevator64.dll with a header-checksum mismatch plus I++u.dll, senddmp.resources.dll, res.dll or Build.dat. Any HKCU Run value or scheduled task named "Canon Configuration Reader" or "Stardock DeElevation Tool" is compromise until proven otherwise, and cleanup order matters: kill the process first, then remove both, or the implanted script restores them within minutes. Treat confirmed infections as full compromise: the RAT enumerates domain and domain-controller details, captures camera and microphone, drives 17 browser families, and dropped a legitimately signed GOMCam2024.exe from %LOCALAPPDATA%\AppstorageFile\ in the investigated cases. Flag outbound HTTP to bare decimal-IP URLs and alert when non-browser processes reach DoH resolvers.

Two developments would change this assessment. The third MSI on the same server, UltraFreeISOCreateWizardSolution.msi seen September 23, says a further signed-host variant is pre-staged, so Canon and Stardock name detections will age out fast and the durable signature is behavioral: msiexec installing a fake product under %LOCALAPPDATA%\Programs, plus a Run key and task sharing one name that regenerate after deletion. The other is platform response: if OpenAI adds review friction or provenance signals to Custom GPTs, or Google polices sponsored ads pointing at GPT pages, the delivery economics collapse; if neither happens, expect copycats on other agent marketplaces and watch for the RAT's C2 "Gate" surfacing as other researchers finish unpacking it.