Malicious actors have begun leveraging OpenAI's custom GPT functionality to orchestrate ClickFix attacks that ultimately deliver remote access trojans to victims. The scheme works by promoting fraudulent GPT variants through sponsored Google search results, which then guide unsuspecting users to compromised sites designed to execute malware installation chains.
The legitimate custom GPT feature allows users to create personalized versions of ChatGPT with tailored instructions, knowledge bases, and capabilities for specific purposes. These custom GPTs are hosted on OpenAI's platform and can be published for public installation. OpenAI announced plans to retire custom GPTs on December 11.
Security firm Huntress, which operates as a managed detection and response provider, discovered the campaign and documented its impact on dozens of affected users. The malicious GPT was labeled 'Plus 5.6' and configured to redirect visitors to a fake backup site hosted on Google Sites.
The compromised page displays a counterfeit Cloudflare verification screen and prompts users to execute a PowerShell command that initiates the infection sequence. Huntress researchers noted that while they had previously observed ClickFix attacks leveraging deceptive ChatGPT conversations, using custom GPTs represents a novel variation of this attack vector.
A critical advantage for attackers is that malicious instructions originate from the legitimate ChatGPT.com domain itself, which enhances credibility and increases the likelihood that victims will comply with the instructions.
Infection Chain and Payload
When executed locally, the PowerShell command installs a malicious MSI package that launches a legitimate, digitally signed application alongside a modified DLL containing the actual malware payload.
The delivered payload functions as a remote access trojan with extensive capabilities including remote desktop access, audio and video capture from connected devices, file system searches, host reconnaissance, and the ability to execute additional payloads.
For maintaining persistence on infected systems, the malware establishes a new Run key in the Windows Registry and creates a scheduled task, both named 'Canon Configuration Reader.'
Campaign Timeline and Evolution
OpenAI removed the initial malicious GPT by September 25. Huntress researchers identified a second GPT variant connected to the same operation on September 27, which remained active at the time of their report publication.
Subsequent iterations of the attack shifted from using a Canon-signed host application to employing a Stardock-signed alternative and modified the concealment and delivery mechanisms for the loader component, though the underlying payload remained unchanged.
Huntress documented at least 40 incidents with connections to the Google Sites page, though only two were confirmed to involve a custom GPT variant.
Technical Sophistication
The attackers demonstrated technical sophistication in phase 6 of their multi-stage attack chain by constructing a custom encrypted file system to obscure the persistence mechanism and RAT.
Instead of one encrypted blob, it's a custom archive with its own folder tree, basically a homemade, encrypted zip file. It starts with a small header, followed by an index of 1,128 entries (one per file or folder, each recording its parent, its size and a per-file key), and then the file contents, packed back to back.
Huntress researchers
Most of the infection chain operates in memory or relies on files that appear legitimate, which complicates detection efforts. However, this architecture also creates opportunities for defenders to identify the attack through process activity monitoring.
Detection Opportunities
Huntress identified several detection indicators that security teams can implement:
- PowerShell invoking msiexec.exe to silently launch an MSI installer from the temporary folder
- A signed application launching from an unusual location under %LOCALAPPDATA%\Programs\
- A matching Run value and scheduled task that reappear if manually deleted by administrators