Attackers are using custom ChatGPT assistants to steer people toward fake security checks that install remote access malware. Huntress researchers linked the custom GPT attacks to a broader campaign involving at least 40 incidents, although they confirmed custom GPT involvement in only two.
The scheme combines sponsored Google results, a legitimate ChatGPT page, and a malicious destination disguised as a backup service.
A Trusted Platform Becomes the Starting Point
The attackers created a custom GPT called “Plus 5.6” and configured it to recommend an alleged backup website. Sponsored Google results helped promote the malicious assistant.
Because the initial instructions appeared on ChatGPT’s legitimate domain, users could mistake the recommendation for a trustworthy service referral.
However, the destination was a Google Sites page containing a fake Cloudflare verification prompt. Instead of completing an ordinary browser check, visitors received instructions to run a PowerShell command on their computers.
This is the central deception behind ClickFix: convincing someone to execute a harmful command under the pretext of solving a technical problem.
The infection therefore depended on users following the instructions outside ChatGPT. Simply viewing the assistant did not complete the malware installation.
Fake Verification Leads to Remote Access
When a victim ran the command, it installed a malicious MSI package. That package then launched a legitimate signed application alongside a modified DLL that loaded the malware.
The final payload was a remote access trojan, or RAT. Its functions included remote desktop control, microphone and camera capture, file searches, and system information gathering.
In addition, the malware could run further payloads, giving the operator options beyond the initial infection.
To maintain access, it created both a Windows Registry Run entry and a scheduled task named “Canon Configuration Reader.”
These mechanisms helped the malware launch again rather than relying solely on the original execution.
Custom GPT Attacks Reappeared After a Takedown
OpenAI removed the first malicious GPT by September 25, according to Huntress. However, researchers discovered another assistant connected to the same campaign on September 27.
That second GPT remained available when Huntress published its findings.
The researchers investigated at least 40 incidents involving connections to the malicious Google Sites page. Nevertheless, only two incidents had a confirmed connection to a custom GPT.
That distinction limits what the findings establish about the campaign’s reach through ChatGPT specifically.
Huntress had previously observed ClickFix operations using deceptive ChatGPT conversations. This campaign instead used a purpose-built custom assistant to deliver the referral.
Attackers Changed Components While Keeping the Same Payload
Later versions of the operation replaced a Canon-signed application with a Stardock-signed application. The attackers also revised how they packaged and delivered the loader, while retaining the same RAT.
One stage concealed the malware and its persistence script inside a custom encrypted archive.
According to Huntress, the archive contained a directory structure and an index of 1,128 file or folder entries. Each entry recorded information such as its parent, size, and individual encryption key.
Meanwhile, much of the infection process operated in memory or relied on files that appeared harmless. This made the relationships between running processes particularly useful for detection.
Process Behavior Offers Investigators Clues
Huntress highlighted PowerShell launching the Windows Installer utility, msiexec.exe, to silently install an MSI from a temporary folder.
Another warning sign involved a signed application running from an unexpected location beneath %LOCALAPPDATA%\Programs\.
In addition, matching Registry startup entries and scheduled tasks that returned after removal could indicate continuing persistence activity.
Together, these behaviors provide investigative leads even when individual files carry legitimate signatures or appear unremarkable.
0 responses to “Custom GPT Attacks Use Fake Verification Checks to Install Remote Access Malware”