Fake ChatGPT Model on Real chatgpt.com Delivers 8-Stage RAT via ClickFix

Threat actors have planted a fake ChatGPT model on OpenAI's own chatgpt.com domain and used it to lure Windows users into installing a sophisticated remote access trojan — no spoofed URL, no lookalike site, and no compromise of OpenAI's systems required. The campaign, uncovered by managed detection and response firm Huntress, marks the first confirmed abuse of Custom GPT as a social-engineering delivery mechanism — and within 48 hours of OpenAI removing the first malicious model, an identical second variant went live .

Fake "Plus 5.6" Lures Victims From Google

Custom GPTs are a legitimate OpenAI feature that lets users and developers build personalized ChatGPT versions for specific tasks, with custom instructions, knowledge files, and integrated tools. Because these models are hosted directly on chatgpt.com , users arriving at the malicious page see the familiar ChatGPT interface and a real OpenAI URL — there is no impersonation of a domain and no typosquatting to detect.

Whatever the victim types into the chat, the Custom GPT returns the same response: a "Service Availability Notice" claiming the primary ChatGPT domain is experiencing "limited availability" and instructing the user to either upgrade their subscription to Plus or visit a backup site to continue. The backup link resolves to a page hosted on Google Sites.

ClickFix: A Fake CAPTCHA Turns the User Into the Installer

The Google Sites page presents itself as a Cloudflare bot-verification check — a fake CAPTCHA that is the signature element of what researchers call a ClickFix attack. Instead of completing a real verification, the victim is instructed to copy a PowerShell command and paste it into their Windows terminal. The ClickFix technique exploits user trust in routine institutional verification steps — users who would never download and run an unknown executable from a website will often willingly paste a command into a terminal when a page presents what appears to be a standard compliance step.

The PowerShell command that ClickFix delivers takes a further step to evade automated filtering: the download server's IP address is written as a decimal integer — 1614733393 — rather than the standard dotted notation 96.62.224.81 . Windows resolves decimal integers natively , but URL-based security filters that scan for dotted IP addresses produce no alert.

Canon's Signature, Attackers' Code: How DLL Sideloading Hid the Infection

If the victim runs the PowerShell command, what follows is one of the more technically intricate infection chains documented in recent months — eight stages in total, engineered so that each hop conceals the .

The PowerShell command downloads a heavily obfuscated script whose sensitive strings — the download URL, the .NET class names needed to fetch the installer — are each encoded separately with a second numeric key, leaving almost nothing readable on disk. Once decoded, the script silently downloads and installs a malicious MSI package named ISOSimple.msi , which presents as "Advanced Printer Configuration Reader" from a publisher called "Softplicity" and hides itself from Windows' Programs list.

The MSI's key payload is DLL sideloading through a legitimately signed Canon application. The attack takes advantage of a foundational rule in how Windows loads software: when an application needs a companion library, Windows searches the application's own folder before looking in system directories. By placing a tampered version of Canon's own logging library — ceiinfolog.dll — to Canon's unmodified COTFileReadApp.exe binary, the attackers ensured their malicious code loaded automatically the moment Canon's legitimately signed binary ran. Canon's executable was never modified; its digital signature checked out. Only the companion DLL was patched — and only with one additional import pointing to the attacker's malicious rdCore.dll . The signature on ceiinfolog.dll itself was stripped, but the DLL that loaded it, and the visible process, remained Canon's signed code.

This technique, classified by MITRE as T1574.002 DLL Side-Loading , means that process-level code signing is insufficient as a defense — because the malicious code runs inside a process that is, at the signature level, entirely legitimate.

Payload Hidden in a WAV File's Audio Data

The malicious rdCore.dll extracted the stage from Common.Integrator.Preview.wav , an audio file with a valid RIFF/WAVE header that passes casual inspection. Real audio data occupies the first portion of the file; at byte offset 0x24362 , the audio samples give way to 341,395 bytes of encrypted payload . The decryption algorithm uses two interlocking counters — each updated per-byte with arithmetic that depends on the byte's position in the stream — meaning every byte of the payload is XORed with a different value and no static key exists anywhere in the file for a scanner to find. The algorithm itself is the key.

Once decrypted, those bytes resolved to raw x64 machine code — shellcode that executed entirely in memory without writing the decoded payload to disk.

Eight Evasion Layers Before the RAT Arrives

The in-memory shellcode loader blinded Windows' Antimalware Scan Interface (AMSI) before executing, removed monitoring hooks placed in ntdll.dll by endpoint detection and response products, checked for virtualization artifacts from six different hypervisors (VMware, VirtualBox, Hyper-V, QEMU, Xen, and Parallels), and displayed a fake "LOADING…" window as cover.

Its final task was locating monitor.raw — a hand-built encrypted archive that functions as the malware's own custom file system. The archive held 315 folders and 806 files, organized with an index of 1,128 entries each encrypted with a master key plus a per-file salt. Within the archive, a persistence script and the final RAT payload were stored in the malware's own scripting language.

The persistence script created two redundant anchors: a Windows Registry Run key and a scheduled task, both named "Canon Configuration Reader," both configured to relaunch the Canon binary. Every 150 seconds, the script verified the Run key existed and recreated it if absent; every 875 seconds, it performed the same check for the scheduled task. Removing one persistence mechanism while the implant is running causes the other to rebuild it within minutes — correct remediation requires killing the process first.

What Does the RAT Actually Do?

The final payload is a 1.58-megabyte shellcode RAT with the full range of post-compromise capabilities. It provides attackers with remote desktop sessions and live screen broadcasts; audio, microphone, and camera capture; a file manager with full-host content ; and the ability to identify and launch any of 17 recognized browsers, from Chrome and Edge to Yandex and Arc.

It can also deploy follow-on payloads — executables, DLLs, MSI installers, PowerShell, VBScript, and ZIP files — either embedded or fetched silently from a remote URL. In most of the incidents Huntress investigated, the RAT dropped a legitimately signed GOM & Company video application ( GOMCam2024.exe ) and launched a hidden Chrome browser session, consistent with credential harvesting or session hijacking as the attacker's objective.

Before making its first outbound connection, the RAT profiled the infected host: installed antivirus, Microsoft Defender status, domain and domain controller details, open ports, installed software, and a detailed hardware fingerprint. Its command-and-control lookups traveled via DNS-over-HTTPS C2 channel queries to Cloudflare, Google, and Quad9 resolvers — hiding C2 traffic inside encrypted HTTPS connections to well-known public DNS services, producing no signal in conventional network-level DNS monitoring.

Does This Attack Scale? It Already Has a Replacement

OpenAI removed the first malicious Custom GPT on September 25, 2026, after Huntress reported it. Two days later, on September 27, a second Custom GPT appeared at a different URL — identical in behavior and naming ("Plus 5.6") but linked to a fresh GPT ID. The second variant retained the same final RAT payload, byte for byte, while swapping the signed host binary: Canon's COTFileReadApp.exe was replaced by Stardock's DeElevate64.exe , and the loader that had been hidden in a WAV file was instead embedded inside a genuine-looking Microsoft NuGet package. The second variant also stripped the Mark-of-the-Web metadata tag from its MSI installer before running it — removing the Windows flag that triggers SmartScreen warnings for internet-downloaded files.

Huntress also found a third MSI installer ( UltraFreeISOCreateWizardSolution.msi ) on the same delivery server, indicating that additional signed host applications may be co-opted in future waves. Because the attacker treats the signed binary as interchangeable outer packaging, detections that rely on Canon- or Stardock-specific file names will miss the version.

Why Trusted AI Domains Are Becoming Malware Infrastructure

The chatgpt.com abuse in this campaign is the latest documented instance of a pattern that security researchers have tracked across multiple AI platforms throughout 2026. In the FakeAgent campaign, a malicious Claude Artifact on Anthropic's own claude.ai domain impersonated the Claude Desktop download page and hit 29 organizations with SectopRAT before it was removed. In the ClaudeFix and LLMShare campaigns, shared conversation links on claude.ai and chatgpt.com posed as technical support guidance delivering macOS infostealers to macOS users. In all of these cases, the malicious content resided on the AI vendor's genuine domain — meaning it passed browser security checks, corporate web filters, and the URL inspection that cautious users perform before clicking.

The Custom GPT campaign escalates the pattern in one important dimension: prior campaigns placed malicious instructions inside shared conversation pages or artifacts. This campaign placed a fully functional fake AI product on the platform — one that a victim might interact with for minutes before encountering the lure — giving it the interactive surface of a real tool, not just a page of text. The LLMShare campaign research from Push Security documented the broader pattern of attackers weaponizing AI platform shared content features.

OpenAI has announced it will retire the Custom GPT feature entirely on December 11, 2026 — creation of new Custom GPTs ended September 25, 2026, per the OpenAI Custom GPT retirement FAQ . That retirement closes this specific attack surface. It does not close the structural vulnerability: every user-generated-content feature on an AI platform inherits the platform's domain trust, regardless of the content's actual origin. Defenders who treat chatgpt.com or claude.ai as inherently safe destinations at the URL level will continue to miss campaigns that exploit exactly that assumption.

How to Detect This Campaign

Huntress recommends defenders focus on behavioral indicators over file names, since the attackers have already demonstrated they will rotate the signed host binary:

PowerShell spawning msiexec.exe to silently install a GUID-named MSI from the temporary folder

A legitimately signed application — Canon's COTFileReadApp.exe or Stardock's DeElevate64.exe — running from %LOCALAPPDATA%Programs rather than its normal installation path

A Registry Run value or scheduled task named "Canon Configuration Reader" or "Stardock DeElevation Tool" that reappears after deletion

Unsigned DLLs ( rdCore.dll , WPFLocalizeExtension.dll , WMPCL.dll ) located in the same folder as the signed host executable

The full indicators of compromise — file hashes, network infrastructure details, and a complete breakdown of both the Canon and Stardock variants — are available in the Huntress technical writeup from September .

Frequently Asked Questions

If I see a "Service Availability Notice" on a ChatGPT page, what should I do?

Close the tab immediately. OpenAI does not redirect users to external sites for service outages, and no real ChatGPT product tier is called "Plus 5.6." A page on chatgpt.com displaying that kind of message and directing you to a Google Sites link is a malicious Custom GPT. Never paste any command into PowerShell or Windows Terminal in response to a web page's instruction, regardless of how trusted the URL appears.

What is DLL sideloading, and why can't antivirus catch it?

DLL sideloading exploits a rule built into Windows: when an application needs a companion library, Windows looks in the application's own folder first. By placing a tampered library to a legitimate, digitally signed executable, attackers run their malicious code inside a process that, at the signature level, appears entirely trustworthy. Conventional antivirus tools that check whether a process is signed — rather than whether every DLL it loads is signed and located in the correct path — will see a valid Canon or Stardock process and produce no alert. Detection requires monitoring which DLLs a trusted binary loads, from where, and whether their signatures match expectations.

Can attackers use other AI platforms the same way?

Yes — and they already have. Security researchers documented three related campaigns in 2026 before this one: a malicious Claude Artifact on Anthropic's claude.ai that delivered the SectopRAT infostealer to at least 29 organizations; shared Claude.ai conversation links that posed as Apple Support and delivered a macOS infostealer; and fake troubleshooting advice seeded into ChatGPT and Grok shared conversations that installed the Atomic macOS Stealer. In every case the malicious content resided on the AI vendor's genuine domain. The Custom GPT campaign represents an escalation in that pattern — a fake interactive product, not just a fake page — but the underlying structural vulnerability, that user-generated content on AI platforms inherits domain trust, applies to every platform's shared or hosted content features.

What should my IT team do today to reduce exposure?

Block or alert on PowerShell spawning msiexec.exe against GUID-named MSI files in temporary directories. Deploy endpoint agents that log DLL load paths and flag unsigned DLLs loaded by signed executables from non-standard installation folders. Train users to never paste terminal commands from any website, regardless of the URL's apparent legitimacy. Review whether your web filtering treats AI platform domains as unconditionally safe destinations — if so, update that policy to treat user-generated content hosted on those domains as untrusted external content requiring the same scrutiny as any other third-party URL.