Malicious Custom GPTs Abused in ClickFix Attack Campaign
Threat actors have been exploiting OpenAI’s custom GPT feature to distribute malware through deceptive AI interactions, according to a report by Huntress. The campaign involves malicious variants of ChatGPT hosted on the legitimate ChatGPT.com domain, which are promoted through sponsored Google search results. These custom GPTs are designed to appear helpful but instead direct users to fraudulent websites that mimic legitimate services.
The attackers created a custom GPT named 'Plus 5.6' that presents itself as a useful tool but is configured to redirect users to a fake backup site hosted on Google Sites. This site displays a counterfeit Cloudflare security check, which instructs visitors to execute a specific PowerShell command under the guise of verifying their system or completing a setup process.
Infection Chain Leverages Signed Binaries and Memory-Based Tactics
When executed, the PowerShell command downloads and installs a malicious MSI file. This installer launches a legitimate, digitally signed application — initially a Canon-signed executable — which then loads a modified DLL. This DLL is responsible for deploying the core payload: a remote access trojan (RAT) capable of performing extensive post-compromise activities.
The RAT provides attackers with remote desktop access, audio and video capture capabilities, file system search functions, host reconnaissance tools, and the ability to download and execute additional payloads. To maintain persistence on infected systems, the malware creates two mechanisms: a Windows Registry Run key and a scheduled task, both named ‘Canon Configuration Reader.’
Attackers Evolve Tactics, Use Encrypted File System for Stealth
Huntress researchers noted that while the initial attack used a Canon-signed host application, later variants switched to a Stardock-signed executable. The method of concealing and delivering the loader was also altered, although the underlying RAT payload remained consistent across versions. This indicates an adaptive threat actor refining their approach to evade detection.
A notable aspect of the attack chain is the use of a custom encrypted file system in phase 6 of the infection process. Rather than storing malware in a single encrypted blob, the attackers built a homemade encrypted archive with a structured folder tree. This archive begins with a small header, followed by an index of 1,128 entries — each representing a file or folder and containing metadata such as parent relationships, size, and individual encryption keys. The actual file contents are packed sequentially after this index.
Much of the infection chain operates in memory or relies on files that appear benign, which complicates traditional file-based detection. Huntress emphasizes that defenders should focus on monitoring process behavior, particularly unusual PowerShell activity and unexpected launches of msiexec.exe from temporary directories.
Detection Opportunities and Indicators of Compromise
Huntress provides specific detection guidance for defenders. Key indicators include PowerShell scripts that silently invoke msiexec.exe to install MSI files from the %TEMP% directory. Another sign is the execution of a signed application from an abnormal location under %LOCALAPPDATA%\Programs\, especially when paired with a Registry Run value or scheduled task named ‘Canon Configuration Reader’ that reappears after deletion.
The firm confirmed investigating at least 40 incidents tied to the malicious Google Sites page, although only two were directly linked to the custom GPT variants. The first malicious GPT was taken down by OpenAI on September 25, 2026. However, a second variant emerged on September 27 and remained active at the time of Huntress’ public report.
Instead of one encrypted blob, it's a custom archive with its own folder tree, basically a homemade, encrypted zip file.
The abuse of legitimate AI platforms like ChatGPT for malware distribution represents a growing trend in social engineering. By hosting malicious instructions on trusted domains, attackers increase the likelihood that users will comply with harmful requests, undermining security assumptions about the safety of official service endpoints.
Source: BleepingComputer