Attackers Use ChatGPT Custom GPTs and ClickFix to Deliver a RAT
Summary
Huntress details a campaign that used attacker-created ChatGPT Custom GPTs to direct victims to a ClickFix lure, leading to a multi-stage RAT infection. Researchers linked the domain to at least 40 incidents and confirmed two Custom GPT-driven infections.
Key points
- Fake Custom GPTs posing as “Plus 5.6” directed users to a Google Sites page disguised as a service backup and CAPTCHA.
- The ClickFix lure instructed victims to run PowerShell, which downloaded and silently installed a malicious MSI.
- The malware sideloaded malicious DLLs through legitimate Canon-signed software; a later version used a Stardock-signed application.
- The multi-stage chain used persistence via a Run key and scheduled task, with payloads concealed in a WAV file or a NuGet package.
- The final RAT can collect host information, capture screen, camera and audio, manage files, and run additional payloads.
- Huntress reported at least 40 incidents tied to the delivery domain, including two confirmed Custom GPT-driven infections; a replacement GPT was found after the first was taken down.
- Huntress recommends detecting suspicious PowerShell-to-MSI activity and signed applications running from fake product folders under %LOCALAPPDATA%\Programs%.
Article Details
- Attack Vectors
- Sponsored Google results led victims to attacker-created ChatGPT Custom GPTs posing as a legitimate product. The GPTs directed users to a Google Sites ClickFix lure.
- The ClickFix page instructed victims to copy and run a PowerShell command, which downloaded obfuscated scripts and a malicious MSI installer.
- The MSI installed a legitimate Canon- or Stardock-signed application that loaded a malicious DLL through DLL sideloading.
- The payload established persistence through a user Run key and a scheduled task, then loaded a RAT and follow-on payloads.
- Defensive Notes
- Monitor for PowerShell launching msiexec to install a GUID-named MSI from %TEMP%, and for signed Canon or Stardock applications launched from unexpected folders under %LOCALAPPDATA%\Programs\.
- Look for the Run value and scheduled task named Canon Configuration Reader or Stardock DeElevation Tool, and for the associated patched or unsigned DLLs and carrier files described in the article.
- The article advises killing the implant process before removing its Run value and scheduled task, because the running persistence script recreates them.
- Do not block COTFileReadApp.exe or DeElevate64.exe globally; the article identifies them as legitimate signed binaries abused as hosts.
Indicators of compromise
| Type | Indicator | Context |
|---|---|---|
| IPV4 | 45[.]140[.]205[.]28 | Payload server observed in a related incident. |
| IPV4 | 96[.]62[.]224[.]81 | Campaign host reported to serve the ClickFix script and MSI. |
| SHA256 | 0457414c4504b70115798eee9c8384a8bf9e793461ffb2e0661a6dcc6ed4809f | Hash of the patched Stardock DLL used in the V2 chain. |
| SHA256 | 14e3376befd4b7b52de0757b6264da294ac6b0f9e4ff51cb9bc5b19b243fe335 | Hash of the obfuscated ClickFix stager identified in the article. |
| SHA256 | 20c7befc174a61117770535e809046c75e93c71284bf1a9c6cd532f55b315f53 | Hash of the loader shellcode decoded from the carrier file. |
| SHA256 | 22869e3326fe1de011cd500e666769027126c5c440b76837baf55139f30094e4 | Hash of the legitimate Stardock-signed binary abused as the V2 payload host; the article cautions against blocking it globally. |
| SHA256 | 278e2f3e2f26c18666b89ef774b4af9ce954e36b2bf54a2392608619245d8c48 | Hash of the legitimate Canon-signed binary abused as the payload host; the article cautions against blocking it globally. |
| SHA256 | 3cd1484cc5bf10e22d79784beba58a75d7b126c46efb5e1a85d6aab884447621 | Hash of the V2 loader DLL. |
| SHA256 | 54c94f85ba6e950903d5ff42c0971c5a9d0741596be26e06afe7d60ec38edf31 | Hash of the audio file carrying the encrypted loader. |
| SHA256 | 6761aad48a3f987238994d92bca97e4b8550e0150607bd67b47b1b6366a371fc | Hash of the malicious ISOSimple.msi installer. |
| SHA256 | 91a22cf3154944897cbcaffc7d20d4596e972d280ee134197d41d8d8eefb0fe2 | Hash of the V2 IconEdit2Turb.msi installer. |
| SHA256 | 9c615db040b88c18ce6b96f30d08797045b7d506f940bea452dc7a6992fdbb8d | Hash of the malicious helper DLL loaded by rdCore.dll. |
| SHA256 | a27cafb84876a3374ef4aba1062345def6cd0b029eaf8e0dc44fa24fc943f3c6 | Hash of the V2 network helper DLL. |
| SHA256 | ab65bbfc505dbe1cebe6021fb36e2011f6aa1d64f5d87cee1cbee3fc2a0c7907 | Hash of the RAT shellcode decoded from the encrypted archive. |
| SHA256 | b59a21a8d4c0c11a9ecbbdbe2a2938499c99c5ebb210c9c6db9683c7ad19f4c4 | Hash of the V2 allocation and execution helper DLL. |
| SHA256 | b77575413c0f97eaf31e4a44c884c1ecdc0049ec89916ceb0bf3aaaedc0442fe | Hash of rdCore.dll, a malicious DLL that decodes and runs the loader. |
| SHA256 | c4603646701069ebdeabc96f74e1f947355ace8575560986d8393fcc6b88d0b7 | Hash of the V2 ClickFix stager identified in the article. |
| SHA256 | d3fda1e6cf886fd530bf62e2d16c39ad23ed12a2c933fc211f1f4876ceaa033e | Hash of the NuGet package carrier containing the encrypted V2 loader. |
| SHA256 | d5acf44658f0dce90bd160f15d8e07a96938c81661d87dc7e9cb0107863bfb90 | Hash of the V2 encrypted archive containing the persistence script and RAT. |
| SHA256 | e58831766e8d4313db9f8b85f90c3a840aa0d84cfeac285beefa40e39ad0d1fb | Hash of the patched Canon DLL with its signature stripped. |
| SHA256 | e614b7d5a7a363fb1b355a87e2e8d9e8a05bbbca08f2cee3d606bdb5015ac53b | Hash of the encrypted archive holding the persistence script and RAT. |
| SHA256 | eff5d63ddf1813962f0d8ad1250cea5486c8bb5dd27c3f432b43957a33e43764 | Hash of a malicious native DLL borrowing the name of an open-source .NET library. |
| URL | hxxp[:]//1614733393/app/50d6565cf39e/IconEdit2Turb[.]msi | V2 malicious MSI download URL. |
| URL | hxxp[:]//1614733393/app/a26b67343315/UltraFreeISOCreateWizardSolution[.]msi | URL for a third installer observed on the campaign delivery server. |
| URL | hxxp[:]//1614733393/app/afafa98279c9/ISOSimple[.]msi | Malicious MSI download URL hosted on the campaign delivery server. |
| URL | hxxps[:]//chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 | Attacker-created Custom GPT used as the initial lure. |
| URL | hxxps[:]//chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6 | Replacement attacker-created Custom GPT linked to the campaign. |
MITRE ATT&CK
T1027 · Obfuscated Files or InformationScripts, strings, shellcode, and archive contents are obfuscated or encrypted to conceal the infection stages.T1053.005 · Scheduled TaskThe malware maintains persistence with a scheduled task.T1059.001 · PowerShellPowerShell downloads and executes the obfuscated script and installs the MSI.T1071.004 · DNSThe RAT uses DNS-over-HTTPS lookups through public resolvers to find its C2 address.T1105 · Ingress Tool TransferThe scripts retrieve the MSI and additional stage content from the campaign server.T1140 · Deobfuscate/Decode Files or InformationThe loader decodes the WAV-carried payload and decrypts content from the archive.T1204.004 · Malicious Copy and PasteThe ClickFix lure instructs victims to copy and run a PowerShell command.T1218.007 · MsiexecThe campaign uses msiexec to install the downloaded MSI silently.T1497.001 · System ChecksThe loader checks for virtualization and sandbox indicators, including CPU vendor strings and virtual-machine drivers and services.T1547.001 · Registry Run Keys / Startup FolderThe malware maintains persistence with a user Run key.T1562.001 · Disable or Modify ToolsThe loader uses an AMSI bypass and ntdll unhooking to evade security inspection and monitoring.T1574.001 · DLLThe Canon and Stardock applications load malicious or patched DLLs placed alongside them.T1620 · Reflective Code LoadingThe loader executes decoded shellcode from memory, and the RAT is also reported to run from memory.
People
Camilo LimaAcknowledged for contributions to the investigation and writeup.Ethan WilliamsAcknowledged for contributions to the investigation and writeup.Jai MintonAcknowledged for contributions to the investigation and writeup.Jonathan SemonNamed as an author of the investigation and writeup.Jose OregonAcknowledged for contributions to the investigation and writeup.Lindsey WelchAcknowledged for contributions to the investigation and writeup.Mark O'HalloranNamed as an author of the investigation and writeup.Ryan EisenhowerAcknowledged for contributions to the investigation and writeup.Susannah MattAcknowledged for contributions to the investigation and writeup.Tanner FilipAcknowledged for contributions to the investigation and writeup.
Vendors
CanonThe payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code.Cloudflarehosted on a Google Sites page. This Google Sites page presents as a CloudFlare CAPTCHA check and delivers a ClickFix attack, telling users to copy-and-paste a command into theirGoogleCustom GPT, which was programmed to respond to their prompts with a message that included a Google Sites link. This link then brought them to a ClickFix-style attack, which led to the download andMicrosoftIn at least one incident, Microsoft Defender quarantined ISOSimple.msi (identifying it as Trojan:Script/Wacatac.H!ml). By then, the installer had already run, and the Run key and the scheduled task continued the attackOpenAIand confirmed that two of these incidents came through a Custom GPT instance. Huntress reached out to OpenAI regarding this specific Custom GPT, and it was taken down as of September 25; however, on September 27StardockThe payload establishes resilient access through dual persistence and DLL sideloading, using a Canon-signed executable (and, in a later wave, a Stardock-signed one) to load malicious code.
Products
Canon CaptureOnTouchLegitimate, Canon-signed, from Canon CaptureOnTouch. Used as the host process.ChatGPTHomeBlogAttackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFixMicrosoft DefenderIn at least one incident, Microsoft Defender quarantined ISOSimple.msi (identifying it as Trojan:Script/Wacatac.H!ml). By then, the installer had already run, and the Run key and the scheduled task continued the attack
Tools
msiexecMSI comes over plain HTTP), downloads the MSI from the same decimal-IP host, installs it silently with msiexec /qn /norestart in a hidden window, and then deletes itself. The MSI is saved under a fresh GUID everyPowerShellThe campaign uses a ClickFix lure to trick victims into running PowerShell, which downloads a malicious MSI and begins a multi-stage, obfuscated infection chain.