ClickFix inside ChatGPT: Malicious Custom GPTs used to deliver a remote access trojan

Researchers at Huntress published on 28 September 2026 the analysis of a campaign that moves the familiar ClickFix trick into a place most security teams have not yet thought to watch: The Custom GPT catalogue of ChatGPT itself. Dark Reading covered the findings two days later. The mechanics are not new, but the choice of venue is, and it defeats the single piece of advice most awareness programmes have been repeating for a decade.

How the lure works

The chain starts with a sponsored search result. Users searching for "chatgpt" clicked an ad that led to the legitimate ChatGPT domain, where the attackers had published two Custom GPTs named "Plus 5.6", a name chosen to look like an official product tier.

The GPT does not try to be useful. When the user types a prompt, it replies with a "Service Availability Notice" and offers a backup address hosted on Google Sites. That page imitates a Cloudflare verification step. Instead of a real CAPTCHA, it asks the user to prove they are human by pressing a key combination and pasting a command into PowerShell.

Every domain the victim sees up to that point is either genuine (chatgpt.com, sites.google.com) or imitates a brand that users have been trained to trust (Cloudflare). URL filtering, reputation scoring and the "check the address bar" reflex all pass.

What the command does

The pasted command uses PowerShell's download cradle to fetch a script into the temporary folder and run it with the execution policy bypassed. The script silently installs an MSI package, ISOSimple.msi, that drops a legitimately signed Canon CaptureOnTouch executable (COTFileReadApp.exe) next to a patched, unsigned copy of a Canon logging library (ceiinfolog.dll).

Windows looks for a DLL in the program's own folder first, so the signed Canon binary loads the attacker's library. That library reads a WAV file, Common.Integrator.Preview.wav, which carries a valid audio header and real audio data, except that roughly 341 KB of it has been overwritten with XOR-encrypted shellcode. The shellcode is the loader, and the loader retrieves the final payload from encrypted storage.

The payload is a full remote access trojan. Huntress describes remote desktop sessions, screen capture, camera and microphone access, integrations for seventeen browsers, file management, account creation and the ability to fetch further payloads. Its command and control traffic rides on DNS over HTTPS through public resolvers, and the C2 address was not present in any file recovered from the infections, which suggests it is held in encrypted settings or delivered at runtime.

In the cases observed, the most common follow-on activity was the installation of additional malware for browser data theft and endpoint mapping, which is the usual prelude to credential sale or a hands-on intrusion.

Scale and response

Huntress traced at least 40 incidents to the Google Sites domain used in the campaign, with two confirmed infections that began inside a Custom GPT. OpenAI removed the first GPT on 25 September after being notified. A replacement with the same name appeared within days, which is what should be expected from an attacker who has already paid for the ads.

Why this matters

ClickFix works because it moves the last step of the intrusion to the victim's own hands. No exploit, no macro, no attachment: Only a person following instructions on a page that looks like a routine check. What this campaign adds is a trusted container for the lure. The ChatGPT platform lends its domain, its login and its interface to the attacker's page, and Google Sites lends a second one.

It also arrives alongside a related evolution we describe in a separate article, in which the lure asks for Windows Terminal rather than the Run dialog. The family is adapting faster than the training material.

What to do now

1. Detect the execution, not the lure. Alert on PowerShell launched with an execution policy bypass and a web download cradle, on msiexec installing GUID-named packages from the temporary folder, and on signed applications running from product-looking folders under the user's local application data.
2. Hunt for sideloading pairs. An unsigned or modified DLL sitting next to a signed executable in a user-writable folder is a strong signal across this campaign and others. Persistence that reappears after deletion, through Run keys and scheduled tasks with identical names, is another.
3. Treat a confirmed ClickFix execution as a RAT incident. Isolate the host, capture memory before rebooting, review DNS over HTTPS traffic from processes that should not generate it, invalidate sessions and reset credentials stored in every browser profile on the machine.
4. Change the awareness message. Replace "check the domain" with "no website, chatbot, support page or verification tool has a legitimate reason to ask you to paste a command". Huntress states the rule in almost those words, and it survives every variant of the trick.
5. Govern AI tooling. If your organisation uses enterprise ChatGPT, review which Custom GPTs are allowed, and treat sponsored search results for AI products the way you treat them for banking: Go to the known address, never through the ad.

A note for insurers and boards

This campaign bypasses the controls that most questionnaires ask about. Web filtering, email security and awareness training all operated as designed and the infection still happened. The questions worth asking are whether endpoint detection would have caught PowerShell installing an MSI from the temporary folder, and whether the organisation has ever tested its response to a remote access trojan on a user workstation. Both are answerable in an afternoon.

Sources

• Huntress: Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix
• Dark Reading: Malicious Custom GPTs used as a ChatGPT RAT delivery lure