Attackers used Custom GPTs hosted on OpenAI's own chatgpt.com domain to funnel people into a ClickFix scheme that installed a remote access trojan, SecurityWeek reported Tuesday, citing research from security firm Huntress. Huntress counted at least 40 infected users, and OpenAI has since removed the first malicious GPT.

What Happened

The operators created Custom GPTs titled "Plus 5.6" and falsely presented themselves as community builders. Victims reached them through sponsored results that appeared at the top of Google searches for ChatGPT. Once opened, the GPT displayed a fake notice saying the service had limited availability on its main domain and pointed users to a "backup" address.

That address was a page on Google Sites showing a counterfeit Cloudflare CAPTCHA check. Instead of clicking images, visitors were told to run PowerShell commands, the hallmark of ClickFix attacks. The commands downloaded a malicious MSI installer.

RelatedFBI Warns Scammers Are Using AI to Impersonate Candidates Ahead of the Midterms

The first version of the chain abused a legitimately signed Canon application to side-load a malicious DLL, and set up persistence through Run registry keys and scheduled tasks disguised as "Canon Configuration Reader." Later stages used a loader dressed up as an audio file, which unpacked a heavily obfuscated archive containing 315 folders and 806 files. The final payload was a remote access trojan that fingerprints the infected system, can fetch and run additional payloads, and reaches its command server using DNS-over-HTTPS through Cloudflare, Google and Quad9 resolvers.

Huntress said its security operations center tied at least 40 incidents to the Google Sites domain used in the attack, and confirmed that two of them came directly through a Custom GPT, according to Help Net Security.

OpenAI removed the first GPT on Sept. 25 after it was reported. A second instance surfaced on Sept. 27 with a modified chain that swapped in Stardock executables and hid loaders in Microsoft NuGet packages rather than audio files, while delivering the same trojan. Help Net Security said that at the time of its report, the replacement was not pointing to the malicious lure.

Why It Matters

ClickFix works because the victim runs the attacker's command, which sidesteps many controls that inspect downloads or email attachments. This campaign layered that technique on top of two sources people tend to trust: a paid Google result and a page on chatgpt.com. A sponsored link that lands on OpenAI's real domain gives the lure far more credibility than a lookalike site.

The use of signed binaries from Canon and Stardock for side-loading, and of mainstream DNS-over-HTTPS resolvers for command traffic, also makes the activity harder to spot with simple reputation checks, since much of it touches software and services that are legitimate in their own right.

What Defenders Can Do

Huntress recommended training users to recognize ClickFix prompts, restricting access to the Windows Run dialog and PowerShell for employees who do not need them, and deploying detections for the behavior, Help Net Security reported. Organizations can also watch for unexpected MSI installs launched from PowerShell and for scheduled tasks named after printer or peripheral utilities.

What to Watch

The quick reappearance of a second GPT suggests takedowns alone will not end the campaign. Attention will fall on how OpenAI screens Custom GPTs that impersonate its own products, and on whether Google tightens ad screening for searches involving major AI brands.