Artificial Intelligence · Cybersecurity
Custom GPTs used to deliver RAT malware
Huntress said sponsored Google results sent users to malicious custom GPTs that pointed them to a fake Google Sites page, where a ClickFix prompt led to RAT malware and persistence.
- Huntress said sponsored Google results led users to malicious custom GPTs in ChatGPT.
- The custom GPT named Plus 5.6 directed visitors to a Google Sites page that mimicked a Cloudflare check and asked them to run PowerShell code.
- If executed, the code installed a malicious MSI that launched a signed application and loaded a RAT with remote access, audio and camera capture, file searching, host reconnaissance and extra payload delivery.
- Huntress said it found at least 40 incidents linked to the Google Sites page, but only two involved a custom GPT, and OpenAI removed the first GPT by September 25.
- Huntress found a second GPT on September 27, and later variants used Canon-signed and Stardock-signed host applications.
Huntress said the campaign used sponsored Google results to send people towards malicious custom GPTs in ChatGPT. The GPT named Plus 5.6 then pointed visitors to a Google Sites page that pretended to be a backup site.
The page showed a counterfeit Cloudflare check and told visitors to run a PowerShell command. Huntress said that command started an infection chain that installed a malicious MSI and loaded code through a modified DLL.
Huntress said the payload was a remote access trojan with remote desktop control, audio and camera capture, file searching, host reconnaissance and the ability to run more payloads. The malware also created a Run key and a scheduled task called Canon Configuration Reader to keep itself present.
Huntress said it investigated at least 40 incidents connected to the Google Sites page, although only two used a custom GPT. OpenAI removed the first GPT by September 25, and Huntress found a second on September 27 that was still active when the report was published. Later versions switched from a Canon-signed host application to a Stardock-signed one and changed how the loader was hidden and delivered.
Named in this story
Companies
- OpenAI
- hosted the custom GPT feature and removed one malicious GPT
- Huntress
- identified the campaign and reported its findings
- provided the sponsored search results and the Google Sites hosting
- Cloudflare
- was impersonated by the fake check page
- Canon
- signed a host application used in an earlier variant
- Stardock
- signed a host application used in a later variant
Products and systems
- ChatGPT
- platform whose custom GPT feature was abused
- Google Sites
- hosted the alleged backup page used in the campaign
- PowerShell
- was used in the command the page told users to run
- Windows Registry
- held the Run key used for persistence
How the source tells it
Measured security reporting with recurring threat emphasis and a small novelty pitch, but anchored in Huntress' observations and practical detection detail.
- threat framing repeated use of malicious labels and counterfeit-check language around the infection chain
- novelty the abuse of custom GPTs was presented as a new variation on earlier ClickFix lures
- operational urgency the piece ended with detection guidance and persistence artefacts for defenders