Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware

Cybercriminals have combined a legitimate function of ChatGPT with ClickFix attacks to infect victims with malware, researchers have found.

Uncovered by cybersecurity firm Huntress, the malware campaign, which has been active since September, abuses the CustomGPT feature of ChatGPT.

CustomGPTs are personalized versions of ChatGPT which users can build to follow specific instructions and workflows.

As detailed in a blog post by Huntress , the attackers manipulated ChatGPT CustomGPTs to impersonate legitimate product offerings and even to interact with victims, to direct them to sites which deliver malware.

The attackers developed a CustomGPT called Plus 5.6 which is designed to look like the real ChatGPT. According to Huntress, users are directed to Plus 5.6 via results after looking for ‘chatgpt’ on Google.

If a user visits the site, the CustomGPT delivers a “Service Availability Notice” which claims there is limited availability for the model on the “primary domain” but directs them to a link for a “backup domain”.

ClickFix Attack Disguised as CAPTCHA

This backup domain initially looks like a CloudFlare CAPTCHA check, which asks the user to paste a command to ‘verify’ themselves.

This is the ClickFix attack, a popular attack technique among cybercriminals , which uses social engineering to trick the victim into running attacker-supplied commands on their own machine. Because the victim themselves has run the command, the ClickFix attack often bypasses any security protections on the machine.

“Every step of the attack also borrows a brand people already trust, from ChatGPT and Google to Cloudflare and even Canon software. The takeaway is simple. No legitimate website will ever ask you to copy and paste a command to prove you’re human,” the company said.

This link directs the user to a malicious Microsoft Software Installer (MSI) which is used to deploy a legitimate Canon-signed application the attackers have used to sideload malicious code, this ultimately establishes persistence on the machine and delivers remote access trojan (RAT) malware .

This RAT can be used to monitor the infected system, including the ability to capture audio and video from microphones and cameras, as well exfiltrate data to a command and control server operated by the attackers. The RAT can also be used to deliver additional malware and malicious payloads to the machine.

According to analysis by Huntress, there have been at least 40 infections related to the campaign. The researchers reported the Plus 5.6 CustomGPT to Open AI, which was taken down as of September 25.

However, researchers have already identified a new CustomGPT linked to the same campaign and Huntress has warned ChatGPT users to be cautious.

Operation Endgame 3.0 Dismantles Three Major Malware Networks News 13 November 2025

Operation Endgame 3.0 Dismantles Three Major Malware Networks

TimbreStealer Malware Targets Mexican Victims with Tax-Related Lures News 29 February 2024

TimbreStealer Malware Targets Mexican Victims with Tax-Related Lures

New Atroposia RAT Surfaces on Dark Web News 29 October 2025

New Atroposia RAT Surfaces on Dark Web

Skype, Google Meet, and Zoom Used in New Trojan Scam Campaign News 6 March 2024

Skype, Google Meet, and Zoom Used in New Trojan Scam Campaign

Lazarus Group Targets Internet Infrastructure and Healthcare with 'QuiteRAT' Malware News 25 August 2023

Lazarus Group Targets Internet Infrastructure and Healthcare with 'QuiteRAT' Malware

What’s Hot on Infosecurity Magazine?

Regulating AI: Where Should the Line Be Drawn?

Japanese Railway Operators Hit with Weekend Cyber Attacks

Zero-Click Vulnerabilities in Salesforce Agentforce Expose Wider AI Agent Risk

US: Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules

Deepfakes Are Becoming a Costly Reality for Businesses, Report Warns

Citrix Patches Critical Zero Days Under Active Exploitation

Who Authorized That Agent? Enforcing AI Authority Before the Action

Experts Alarmed Over Gyazo’s Breach of 490 Million Metadata Records

US: Critical Infrastructure Braces for Sweeping New Cyber Reporting Rules

ShinyHunters Claims FBI Hack Via PeopleSoft Zero Day

AI Security Awareness is the New Frontline of Cybersecurity

CISA Charts New "Quality Era" for Global CVE Program

Your Security Awareness Programme Isn't Failing, It's Just Not Relevant

From APIs to Agents: How to Secure AI at Enterprise Scale

Frontier AI: How Cyber Defenders Can Harness the Defender’s Window

Human Risk in Cybersecurity: Protecting Your Organization Beyond Technology

Why Resilience‑Focused Cloud Design Is Your Best Defense Against Modern Attacks

How To Enhance Security Operations with AI-Powered Defenses

How Faster Cyber-Attacks Are Reshaping Enterprise Cybersecurity Strategies

Researchers Claim First Fully Agentic Ransomware: JadePuffer

AI is Already Powering Cyber-Attacks. Can it Power Cyber Defense?

Google Cloud's New CISO Chris Betz on Integrating AI in Cyber Defenses

How World Cup Password Trends Can Increase Active Directory Risk

New CISA Guide Helps Agencies Adopt SASE For Zero Trust