Malicious ChatGPT Custom GPTs Deliver RATs Through ClickFix Attack
Summary
Huntress describes a campaign using malicious Custom GPTs on the real ChatGPT domain to direct victims to fake verification pages, where ClickFix prompts lead to a PowerShell-driven infection chain and RAT deployment.
Key points
- Attackers created two Custom GPTs mimicking real products and used the trusted ChatGPT domain to direct victims to a malicious Google Sites page.
- The page presented a fake Cloudflare CAPTCHA and prompted victims to run a PowerShell command, which downloaded an MSI and began the infection chain.
- The MSI abused a Canon-signed application to sideload malicious DLLs; a loader concealed in a WAV file ultimately retrieved and unpacked a RAT.
- Huntress reported at least 40 incidents linked to the Google Sites domain, including two traced to a Custom GPT instance.
- Investigated follow-on activity included additional malware intended to steal browser data and map victims' endpoints.
- The RAT can steal data, monitor users, create accounts, and provide remote access; Huntress said its detections helped isolate machines before further tools were installed.
- Huntress advises users not to paste commands into PowerShell or a terminal for verification, regardless of how legitimate the website or chatbot appears.
Article Details
- Attack Vectors
- Attackers used malicious Custom GPTs resembling legitimate ChatGPT offerings to direct victims to a Google Sites link and then a fake Cloudflare landing page.
- A ClickFix prompt tricked victims into copying and executing a PowerShell command, which downloaded an MSI file and started a multistage infection chain.
- The MSI abused a legitimate Canon-signed application to sideload malicious DLLs. A DLL extracted and decrypted a loader concealed in a WAV file; the loader then retrieved and unpacked a RAT.
- Researchers reported a variant using a different loader carrier and signed application, with a broadly similar infection chain.
- Defensive Notes
- Huntress advised that users should not paste commands into PowerShell or any Terminal in response to a website, chatbot, support page, or verification tool.
- Huntress updated detections and isolated affected machines before additional malware was installed in most of the investigated chains.
MITRE ATT&CK
T1059.001 · PowerShellThe pasted command executed through PowerShell to download an MSI file.T1105 · Ingress Tool TransferThe PowerShell command downloaded an MSI, and the loader retrieved the RAT from a separate encrypted storage file.T1204.004 · Malicious Copy and PasteVictims were tricked by a ClickFix prompt into copying and pasting a command into PowerShell.T1574.002 · DLL Side-LoadingThe MSI abused a legitimate Canon-signed application to sideload malicious DLLs.
People
Vendors
HuntressThat's according to Huntress, which this week published its findings about a new campaign that involves malicious Custom GPTs. As the name suggests, these are customized versions of ChatGPT that users and organizationsOpenAIand Jonathan Semon, attackers created Custom GPTs to mimic real product offerings, then leveraged OpenAI's trusted Web infrastructure to direct victims to a malicious site. Victims would then be served a
Products
ChatGPTA new ClickFix attack abuses the real ChatGPT Web domain to infect victims with remote access Trojans (RATs).Cloudflaretheir subscription or use the "backup" domain, which is a Google Sites link. That link goes to a fake Cloudflare landing page with a fake CAPTCHA, where the user ultimately gets a standard ClickFix prompt to kick offGoogle Sitessecurity operations center (SOC) "has responded to at least 40 incidents stemming from the specific Google Sites domain involved in this attack, and confirmed that two of these incidents came through a Custom GPTPowerShellsite. Victims would then be served a ClickFix-style prompt that attempts to trick them into executing a PowerShell command, which then downloads an MSI file and kicks off the attacker's multistage infection chain.