Attackers have found another way to cash in on the trust people place in AI platforms. In late September 2026, Huntress spotted a campaign in which custom ChatGPT assistants (Custom GPTs) posed as an official OpenAI offering and sent users to malicious pages running ClickFix lures. According to the researchers, at least 40 people were infected.
This is not the first time AI platforms have been turned into a delivery channel. Earlier campaigns used shared chatbot conversations and malicious Claude Artifacts to spread infostealers and remote access trojans (RATs). Custom GPTs are simply the next feature on the list.
Why Custom GPTs work so well for attackers
A Custom GPT is a personalized version of ChatGPT. Its creator writes the instructions, uploads reference files and enables the capabilities it needs, all without writing a line of code. The assistant is served from the legitimate chatgpt.com domain, with its name shown at the top of the page. To the victim it looks like ordinary ChatGPT — there is nothing to raise suspicion.
How the attack unfolds
It starts with a sponsored Google result for searches like “chatgpt”. The ad leads to a Custom GPT named “Plus 5.6”. Researchers identified two of them (URLs defanged):
- chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6
- chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6
Whatever the user types, the assistant replies with a scripted “Service Availability Notice”. It claims the primary domain has limited availability and offers two options: upgrade the subscription, or switch to a “backup domain” hosted on Google Sites. To steer users toward the second option, the notice adds that the backup domain is the way to go if you need access right now.
On the Google Sites page, the victim is greeted by a fake Cloudflare CAPTCHA. This is textbook ClickFix: the user is talked into copying a command and running it on their own machine. Here it is a PowerShell command that downloads an MSI installer, ISOSimple.msi.
The infection chain
From there the attackers move in stages, and each stage is designed to stay under the radar of security tools.
- DLL sideloading through a Canon-signed binary. The installer launches COTFileReadApp.exe, a legitimate program signed by Canon, which loads ceiinfolog.dll — a genuine Canon DLL, but a modified one: it loads a second, unsigned library, rdCore.dll.
- A loader hidden in an audio file. rdCore.dll extracts an encrypted loader from a WAV file, Common.Integrator.Preview.wav. Hiding payloads in audio and video files is nothing new, and WAV containers have already turned up in Octowave Loader campaigns.
- Evading defenses and checking the environment. Before unpacking the main payload, the shellcode disables AMSI and restores a clean copy of ntdll.dll in memory — a technique known as unhooking, which strips out the hooks EDR and antivirus products rely on to watch user-mode processes. The loader then checks whether it is running in a virtual machine: it compares the CPU vendor string and looks for drivers and services belonging to VMware, VirtualBox, Hyper-V, QEMU, Xen and Parallels, so it can avoid sandbox analysis.
- Final payload. The RAT and a persistence script are unpacked from an encrypted container, monitor.raw.
What the trojan can do
The RAT comes with a broad feature set. It:
- profiles the system, installed antivirus and Microsoft Defender status;
- runs remote desktop sessions and streams the screen;
- captures webcam video, microphone input and system audio;
- recognizes 17 web browsers and can launch the default one;
- searches file contents across the system with a built-in file manager;
- drops and runs additional payloads (EXE, DLL, MSI) and scripts (PowerShell, batch, VBScript, JavaScript).
The way it finds its command-and-control server — which its strings call the “Gate” — deserves a closer look. The RAT resolves it over DNS-over-HTTPS through Cloudflare, Google and Quad9. Those lookups travel inside ordinary HTTPS traffic to well-known resolvers, so they never show up in local DNS logs. The researchers believe the server address itself is either stored encrypted deep in the code or retrieved at runtime.
The trojan also consistently drops GOMCam2024.exe, a legitimately signed program that launches Google Chrome with a throwaway profile in the %TEMP% directory.
Huntress sums it up this way: attackers keep turning trusted platforms into convincing entry points for social engineering, whether that is ChatGPT’s Custom GPT feature or Google Sites hosting a ClickFix page. The same trust-abuse logic increasingly shows up in attacks that target AI and LLM-powered systems directly, not just the humans who use them.
ClickFix is not going anywhere
Around the same time, researchers at several other companies documented more ClickFix campaigns.
Fake AI tool installers. Phishing pages on Google Sites impersonate OpenAI Codex and Anthropic Claude. The victim sees a fake installation guide, and ClickFix launches an infostealer that runs entirely in memory. It fingerprints the host, pulls next-stage modules from an external domain and steals data, including cryptocurrency wallets.
ClearFake, WebDAV and Amatera Stealer. A website, most likely compromised, used EtherHiding to pull JavaScript from the blockchain and display a fake ClearFake-style reCAPTCHA. The victim was pushed into running a command that opened a WebDAV share and fetched a DLL, which then installed Amatera Stealer in several stages. On top of stealing data, the stealer ran three more payloads: a NativeAOT loader, ZigCryptoStealer and a reverse TCP proxy written in Go. Another build installed NetSupport Manager. Some of these attacks targeted Ukrainian government systems, and Cisco Talos attributes them to a Russia-aligned cluster tracked as UAT-10820.
Bulletproof hosting and disposable domains. Malvertising, phishing emails and a compromised online store sent users to a fake Cloudflare interstitial page hosted with a bulletproof provider (AS202412, registered to Seychelles-based OMEGATECH LTD). From there the attackers delivered a trojanized installer carrying an infostealer, a Node.js implant, and a batch script that persists through the Windows Active Setup registry key.
The blockchain as a C2 channel. Another campaign, active since at least November 2025, relies on 31 compromised business websites that show a fake CAPTCHA. A dropper runs a PowerShell script that sets up persistence and installs a C2 agent. The agent looks up its server address on the Polygon blockchain (EtherHiding again), then receives and executes arbitrary PowerShell commands. According to GuidePoint Security, this backdoor has since started delivering a banking trojan that intercepts logins and two-factor codes for major banks and crypto exchanges in real time, as victims type them.
How to shut the door on ClickFix
All of these campaigns share one thing: the user runs the malicious command themselves, because they trust the platform in front of them — it might be chatgpt.com, Google Sites or a “Cloudflare check”. A few measures go a long way against this pattern:
- Restrict the Run dialog. ClickFix almost always depends on Win+R and a command pasted from the clipboard. Group Policy can disable the dialog for regular users, and EDR can alert when explorer.exe spawns powershell.exe or mshta.exe with encoded arguments.
- Control DNS-over-HTTPS. If the organization runs its own DNS, direct DoH traffic from workstations to public resolvers should be blocked or at least monitored. Otherwise network monitoring for malicious domains is flying blind.
- Watch for sideloading. A signed executable running from a temp or user directory and loading an unsigned DLL should raise an alert, even when the signature belongs to a well-known vendor.
- Teach one simple rule. No real service, CAPTCHAs included, ever asks you to paste a command into a terminal. And no official AI service will ever send you to a “backup domain” on Google Sites — testing whether your own people would catch that is exactly what a phishing simulation or a broader social engineering assessment is for.
ClickFix is a social-engineering delivery mechanism first and a malware problem second, which is exactly the kind of chain our red team operations are built to test end to end, from the first click to the final payload.