Malicious Custom GPT on chatgpt.com lures users into installing a RAT

Malware peddlers are using Google results to push a malicious ChatGPT Custom GPT named “Plus 5.6,” created to lead users to a fake Cloudflare CAPTCHA check and, ultimately, make them download and run a remote access trojan (RAT).

“The campaign has impacted dozens of users: the Huntress SOC has responded to at least 40 incidents stemming from the specific Google Sites domain involved in this attack, and confirmed that two of these incidents came through a Custom GPT instance,” Huntress researchers warned.

How the attack unfolds

This malware delivery campaign was spotted in late September. Links to the Custom GPTs appeared in Google results for users searching for “chatgpt”.

Those who followed the links landed on the malicious Custom GPT pages, created through a ChatGPT feature and located on the legitimate chatgpt.com website.

When users tried to use the attacker-created Custom GPT, it told them that the service was unavailable and directed them to a “Backup Domain” (on a Google Sites page):

The Custom GPT points users to the fake CAPTCHA check (Source: Huntress)

“This Google Sites page presents as a CloudFlare CAPTCHA check and delivers a ClickFix attack, telling users to copy-and-paste a command into their Terminal,” Huntress researchers explained .

Users who ran the command triggered a chain that ended with a full-featured RAT being sideloaded through legitimately signed Canon (and, in a later wave, Stardock) executables.

After the researchers observed and reported the first malicious Custom GPT, OpenAI removed it. It didn’t take long, though, for the crooks to create another one and push it to Google users. And while the infection chain was slightly different the second time around, the goal and the delivered RAT were the same.

This second Custom GPT is still online, though it doesn’t point to the malicious ClickFix lure anymore (we checked). According to the researchers, however, the attackers are already working on a new installer.

“These campaigns often stay live for just hours or days before the provider takes the content down, but even in that short span, they can draw considerable attention,” the researchers noted.

What users and organizations can do

The advice for end users is simple: no legitimate website, CAPTCHA, or “fix” will ever ask you to copy something and paste it into the Run dialog, Terminal, PowerShell, or a command prompt. If a page asks for that, it’s an attack.

Users should also be wary of results and not trust a page just because of where it’s hosted.

For organizations, the goal is layered defense. They should train users so that fewer of them fall for the ClickFix trick, make it harder to act on the instructions (e.g., by restricting the Win+R Run dialog for standard users, locking down PowerShell, etc.), and make sure their security teams can detect the attack if those protections can’t be implemented.

Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)

Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day

Download: The High-Performance Team Playbook

Simplify security management with CIS SecureSuite Platform

Download: The IT and security field guide to AI adoption

Apple squashes zero-day bug exploited in “extremely sophisticated” attack (CVE-2026-86950)

Hackers exploit SQL injection flaw to steal patient data from Polish medical software provider

A four-week plan to tackle vendor concentration risk

FBI job portals remain offline after ShinyHunters claims breach via PeopleSoft zero-day

16-year-old researcher breaks into Microsoft analytics service with access to 17 trillion rows of data