blog

Malicious ChatGPT Custom GPTs, ClickFix, and a RAT

I read a Huntress investigation into attackers using ChatGPT Custom GPTs and ClickFix to install a RAT. Here’s what stood out to me as an IT admin.

cybersecurity endpoint-security social-engineering it-operations

Infographic: ChatGPT Custom GPT used as part of an attack chain: malicious Custom GPT, redirect, fake Cloudflare ClickFix page, PowerShell execution, RAT deployed

I came across this Huntress investigation and figured it was worth a short note for anyone who looks after endpoints or helps users day to day.

Apparently, attackers have been using malicious ChatGPT Custom GPTs as part of an attack involving ClickFix and a remote access Trojan (RAT).

How the chain worked

What caught my attention was how the whole thing fitted together.

The attackers created a Custom GPT disguised as a ChatGPT upgrade called “Plus 5.6”. Users were then directed to another website, supposedly because the main service was unavailable.

That website displayed a fake Cloudflare verification page and instructed users to copy and run a command on their computers.

And that is where things get nasty.

This is a technique known as ClickFix, where attackers trick users into running malicious commands themselves rather than simply exploiting a vulnerability. In this case, the commands triggered PowerShell activity that eventually led to the installation of a RAT.

Depending on its capabilities, this type of malware can give attackers access to files and let them monitor activity or use the victim’s camera or microphone.

I am not claiming to have dissected the samples myself. Huntress published a detailed write up of the campaign, including how a ChatGPT experience that looks legitimate funnels people into that ClickFix page. If you want the full technical chain, their post is the place to start.

What stood out to me

A few things stood out from this case:

  1. A familiar platform is not automatically safe. Attackers lean on trust. A page that looks like it belongs on chatgpt.com can still be a Custom GPT built by an attacker.
  2. Be careful about commands you copy and run. A website asking you to paste something into PowerShell or the Windows Run dialog should raise questions, especially if you do not understand what the command does.
  3. A valid digital signature does not automatically mean something is safe. I still need to look at what a program does, not just whether it is signed. Signed binaries can still be abused as part of a longer infection chain.

Takeaway

I’m still learning about security, and cases like this help me see how much sits beyond the tools. I want to get better at spotting suspicious behaviour and helping users avoid these traps.

If a user ever says a website asked them to “verify” by running a command, treat that as a red flag and investigate before anyone pastes anything.

Definitely worth a read if you are interested in cybersecurity: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix (Huntress).

Originally shared on LinkedIn.

← All posts