Hackers Exploit ChatGPT Custom GPTs In ClickFix Malware Attacks

Cybersecurity firm Huntress has revealed that hackers used fake ChatGPT Custom GPTs to trick users into running malicious PowerShell commands, infecting at least 40 victims.

Hyderabad: A newly discovered malware campaign is using ChatGPT's Custom GPTs to impersonate legitimate products. According to a report by a cybersecurity firm, Huntress, these Custom GPTs tricked victims into running harmful code on their computers.

For the unversed, Custom GPTs are personalised versions of ChatGPT that can include specific instructions and tools. They are hosted on ChatGPT.com, with each page displaying the assistant's custom name and the builder's profile.

How did the attack work?

As part of the campaign, a threat actor set up two Custom GPTs designed to respond to user prompts with a link to a Google Sites page. It led to a ClickFix attack page, which told visitors to run PowerShell commands, downloading a malicious MSI file as part of a multi-stage infection process.

Huntress said at least 40 users have been infected through the campaign, with at least two confirmed cases linked directly to a Custom GPT. OpenAI removed the first malicious Custom GPT on September 25, but a second one was discovered just two days later on September 27.

The cybersecurity firm warned that cyber threat actors are finding success by abusing Custom GPTs for social engineering and are likely to continue using this method.

How were victims tricked?

Victims typically found the Custom GPT after searching for ChatGPT on Google, where the fake page appeared as a result at the top of the results.

To deceive users, the attackers named the Custom GPT "Plus 5.6" and claimed it had been made by a "community builder". Victims were shown a fake notice stating limited availability on the main domain and were told to use a backup domain instead.

This backup domain, hosted on a Google Sites page, displayed a fake Cloudflare check as part of the ClickFix technique. Victims were then instructed to run a PowerShell command that downloaded and launched a malicious installer.

The first Custom GPT delivered an installer that abused a legitimate, Canon-signed application to sideload a malicious file. It then established persistence on the system using a Run key and a scheduled task disguised as a "Canon Configuration Reader".

The infection then continued with a loader disguised as an audio file, designed to avoid detection by security software, check the system's setup and display a fake loading screen.

At a later stage, malicious code was loaded from a heavily disguised audio file containing a hidden archive with 315 folders and 806 files. This included the final payload, a remote access tool (RAT) capable of fetching, processing, and running various types of malicious code.

The malware then identified details of the infected system and connected to its command-and-control server using encrypted DNS traffic routed through Cloudflare, Google, and Quad9.

While the second Custom GPT delivered the same final payload, the attacker used a different method. This version used a Stardock executable file and an altered Stardock DLL file, with the loader hidden inside a Microsoft NuGet package rather than an audio file.