Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT

Gbhackers •Mayura Kathir • September 1, 2026

Threat actors are abusing legitimate ChatGPT shared-conversation URLs to host social-engineering lures that steer victims into a ClickFix-style infection chain, ultimately delivering a NetSupport remote-access tool (RAT). The observed chain begins with a legitimate ChatGPT shared link, chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8, which displays a fabricated availability notice claiming: “We are experiencing high traffic now. Continue on our backup […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Malicious Use of ChatGPT Links to Distribute NetSupport RAT Threat actors are exploiting legitimate ChatGPT shared links to deploy the NetSupport remote-access tool (RAT) through social engineering tactics. Victims are misled by a fabricated message claiming high traffic on the ChatGPT platform, prompting them to follow malicious instructions. The attack primarily targets Windows users, steering them into a ClickFix-style infection chain. The specific shared link used in the attack is chatgpt.com/s/t_6a80bc61c434819190c3eae5932307e8. This campaign highlights the increasing use of trusted platforms for malware distribution. Current reports indicate ongoing exploitation of this method, affecting a wide range of users. The full scope of the impact is still being assessed as the campaign unfolds. 2 sources 62

Extracted Entities

Hackers Abuse Legitimate ChatGPT Shared Links to Deploy NetSupport RAT

The full story

Extracted Entities

Attack Types (2)

Domains (1)

Malware (1)

MITRE ATT&CK (1)

Platforms (1)