Cybercriminals Exploit ChatGPT Custom GPTs for ClickFix RAT Attacks

• •Attackers are using ChatGPT Custom GPTs to distribute malware via ClickFix techniques.
• •At least 40 users have been confirmed infected, with two incidents linked to Custom GPTs.
• •OpenAI has removed the malicious Custom GPTs, but new instances continue to appear.

A new ClickFix campaign has been discovered that exploits ChatGPT Custom GPTs to impersonate legitimate products, luring users into executing malicious code. Cybersecurity firm Huntress reported that at least 40 users have been infected, with two confirmed incidents linked to Custom GPT instances. The attackers created Custom GPTs that directed victims to a Google Sites link, leading to a malicious page that instructed users to run PowerShell commands to download a malicious MSI file. This file then deployed a remote access trojan (RAT) by sideloading malicious DLLs using legitimate Canon and Stardock executables. OpenAI took down the first Custom GPT on September 25, but a second one was discovered shortly after. The campaign highlights the ongoing abuse of AI platforms for social engineering attacks.