Malicious Custom ChatGPTs Lure Users Into ClickFix RAT Attacks
Summary
Huntress says malicious custom ChatGPTs promoted in sponsored Google results led users to a fake backup page and ClickFix PowerShell commands that installed a RAT. The malware used Windows Run keys and scheduled tasks for persistence.
Key points
- Sponsored Google results promoted malicious custom GPTs that directed users to a fake backup site hosted on Google Sites.
- The site used a fake Cloudflare check to persuade visitors to run a PowerShell command, launching the infection chain.
- The command installed a malicious MSI that launched a signed application and modified DLL used to load malware.
- The RAT could enable remote desktop access, capture audio and camera input, search files, gather host information, and run additional payloads.
- The malware created a Windows Registry Run key and scheduled task, both named “Canon Configuration Reader,” to maintain persistence.
- Huntress investigated at least 40 incidents connected to the Google Sites page, but confirmed that only two involved a custom GPT variant.
- Huntress described a custom encrypted archive used to conceal persistence scripts and the RAT, and highlighted process activity monitoring as a detection opportunity.
Article Details
- Attack Vectors
- Sponsored Google results promoted malicious custom GPTs that directed users to a fake backup site hosted on Google Sites.
- The site displayed a fake Cloudflare check and used a ClickFix ruse to persuade visitors to run a PowerShell command.
- The command silently launched an MSI installer, which started a signed application and a modified DLL that loaded the malware.
- The RAT established persistence using a Windows Registry Run key and a scheduled task, both named “Canon Configuration Reader.”
- Defensive Notes
- Huntress recommends monitoring process activity, including PowerShell launching msiexec.exe to silently run an MSI from a temporary folder.
- Investigate signed applications running from unusual folders under %LOCALAPPDATA%Programs, along with matching Run values and scheduled tasks that reappear after deletion.
MITRE ATT&CK
T1053.005 · Scheduled TaskThe malware created a scheduled task named “Canon Configuration Reader” for persistence.T1059.001 · PowerShellThe ClickFix page instructed victims to run a PowerShell command that initiated the infection chain.T1218.007 · MsiexecPowerShell launched msiexec.exe to silently install an MSI from a temporary folder.T1547.001 · Registry Run Keys / Startup FolderThe malware created a Windows Registry Run key named “Canon Configuration Reader” for persistence.T1574.002 · DLL Side-LoadingThe MSI launched a signed application alongside a modified DLL that loaded the malware.