The latest ClickFix campaign analyzed by Huntress demonstrates an important evolution in social engineering: attackers are no longer merely impersonating trusted brands such as ChatGPT. They are placing part of the attack inside the legitimate platform itself.

Threat actors created malicious Custom GPTs hosted on the genuine chatgpt.com domain, gave them names designed to look like legitimate ChatGPT model offerings, and then promoted them through sponsored Google search results. Victims searching for ChatGPT could therefore click an advertisement, land on the real ChatGPT website, and interact with what appeared to be a legitimate AI service before being redirected toward the actual malware-delivery infrastructure.

That greatly strengthens the lure because several of the signals users normally rely upon are genuine.

The domain is genuine.

HTTPS is genuine.

The ChatGPT interface is genuine.

The AI conversation is genuinely being delivered through ChatGPT.

What is malicious is the Custom GPT created by the attacker and the instructions it gives the victim.

Huntress identified two attacker-created Custom GPTs associated with the campaign. One was titled “Plus 5.6,” apparently chosen to resemble an official ChatGPT model or subscription offering. When users interacted with it, the GPT returned a supposed “Service Availability Notice” claiming that the primary service had limited availability and suggesting that the user continue through a “backup domain.”

That backup location was hosted on Google Sites.

The victim had therefore already moved through two widely trusted cloud platforms before reaching the overtly malicious stage:

Google sponsored search → legitimate ChatGPT Custom GPT → Google Sites → fake Cloudflare verification → ClickFix command → malware

This is one of the more significant lessons from the campaign.

Attackers are building chains of borrowed trust.

No single piece necessarily looks suspicious enough on its own.

A Google advertisement leads to ChatGPT.

ChatGPT points to Google Sites.

Google Sites displays what looks like Cloudflare verification.

Only after several trust transitions does the victim receive the malicious instruction.

The final lure is a familiar ClickFix technique. The Google Sites page presents what appears to be a Cloudflare CAPTCHA or verification check and instructs the user to copy and execute a PowerShell command manually.

That action begins the actual compromise.

The PowerShell command downloads an obfuscated script into %TEMP%, executes it, retrieves a malicious MSI installer, and silently starts a multi-stage malware chain.

This is why the Custom GPT itself should not be described as directly executing malware on the victim's computer.

The GPT acts as the delivery and persuasion mechanism.

The victim still performs the critical execution step.

That distinction is technically important because it shows that the attack does not require a vulnerability in ChatGPT, Google Sites, Cloudflare, or Windows.

Instead, attackers exploit the user's trust in those brands and persuade the user to become the execution mechanism.

The initial PowerShell stage is also heavily obfuscated. Huntress found scripts containing thousands of negative integers that are mathematically transformed back into executable PowerShell at runtime. Additional strings, including download locations and API names, are separately encoded.

The result is that very little recognizable malicious content appears directly in the script stored on disk.

The attackers also represented one payload server as a decimal IP address rather than normal dotted notation. For example, Windows interprets:

1614733393

as:

96.62.224[.]81

A user, proxy rule, or basic detection signature looking specifically for conventional dotted IPv4 addresses may therefore miss the destination.

This is a small technique, but it demonstrates how attackers continue to combine old Windows behaviors with modern social engineering.

The malicious MSI then installs itself as what appears to be an innocuous utility called Advanced Printer Configuration Reader and hides itself from the normal Windows Programs and Features interface.

From there, the attackers rely heavily on DLL sideloading.

The first observed campaign deployed a legitimate, properly signed Canon executable named COTFileReadApp.exe. Rather than modifying that executable directly, the attackers placed manipulated and malicious DLLs alongside it.

Windows loads local DLL dependencies from the application directory, allowing the trusted Canon executable to load the attacker's code.

This is a particularly useful evasion technique because defenders inspecting only the executable may see a legitimate Canon-signed binary.

The malicious behavior exists in what that trusted application loads next.

One of the Canon DLLs used in the chain had been modified to introduce an additional dependency on an attacker-controlled component called rdCore.dll. Once the signed Canon application loaded the altered DLL, Windows automatically brought the malicious dependency into the same process.

The signed application therefore becomes a trusted-looking host for attacker code.

The malware chain then becomes considerably more elaborate.

Huntress describes eight distinct stages, far more than the simple two- or three-step ClickFix infections commonly seen.

One stage hides encrypted loader shellcode inside what appears to be a legitimate .wav audio file.

The WAV file contains genuine audio data at the beginning, followed later by encrypted executable material.

The malware seeks to a specific offset inside the audio file, extracts hundreds of kilobytes of encrypted content, decodes it in memory, and executes the resulting x64 shellcode.

Strictly speaking, this is not sophisticated audio steganography.

The attackers have simply embedded ciphertext inside a file that still carries a valid audio structure.

But that may be enough to mislead security tooling that relies too heavily on file extensions or headers.

The loader itself contains several defensive-evasion capabilities.

Huntress identified functionality for bypassing AMSI, loading a clean copy of ntdll.dll to evade hooks placed by endpoint-security products, detecting common virtual-machine and sandbox environments, and executing .NET code directly from memory.

This shows that the campaign is not merely relying on social engineering.

Once the victim executes the initial command, the malware chain makes a deliberate effort to reduce endpoint visibility.

The next stage uses an encrypted file called monitor.raw, which Huntress describes as effectively a custom encrypted filesystem.

Rather than storing one obvious payload, the attackers created their own archive structure containing more than a thousand files and directory entries.

Inside that encrypted structure are configuration settings, persistence logic, scripts, and the final RAT payload.

This modular design has an operational advantage.

Attackers can modify configuration, persistence settings, timings, or the final payload simply by replacing the encrypted container rather than recompiling the entire malware chain.

That suggests a maintained malware framework rather than a one-off proof of concept.

Persistence is deliberately redundant.

The malware creates both an HKCU Run key and a scheduled task, initially using the name:

Canon Configuration Reader

A background script periodically checks whether either persistence mechanism has been removed and recreates it if necessary.

That detail is particularly relevant for incident response.

Deleting the registry Run value while the malware process is still running may accomplish very little because the implant can restore it minutes later.

The correct containment sequence becomes important:

isolate the host → terminate malicious processes → remove persistence → remove payloads → revoke potentially exposed credentials → investigate follow-on activity

The final payload is a full-featured remote access trojan rather than a simple downloader.

Huntress found functionality for remote desktop control, screen broadcasting, microphone capture, camera access, system-audio capture, file management, detailed file searching, host reconnaissance, and execution of additional malware.

The RAT can inventory antivirus products, Microsoft Defender status, domain and domain-controller information, network adapters, open ports, installed applications, Windows features, and detailed hardware information.

It also supports delivery of numerous follow-on payload formats including EXE, DLL, MSI, PowerShell, Batch, VBScript, JScript, and ZIP content.

That means successful infection should be treated as full endpoint compromise, not merely removal of one malware file.

An attacker controlling this RAT can interact with the host, observe the user, retrieve files, run additional tools, and potentially begin lateral movement into the enterprise network.

The malware also uses DNS-over-HTTPS through services such as Cloudflare, Google, and Quad9 as part of its command-and-control discovery.

This makes monitoring more difficult because DNS requests are encapsulated inside ordinary HTTPS sessions to widely trusted resolvers rather than appearing in conventional local DNS logs.

Organizations that allow unrestricted external DoH therefore risk losing part of the DNS visibility historically used for malware detection.

The campaign also changed rapidly after defenders began disrupting it.

Huntress reported the first malicious Custom GPT to OpenAI, and it was removed by September 25. Only two days later, researchers identified another Custom GPT connected with the same campaign.

The second wave changed several implementation details while retaining the same final RAT.

The attackers switched from the Canon-signed executable to a legitimate Stardock-signed DeElevate64.exe binary and again modified a DLL dependency to sideload malicious code.

The loader also stopped hiding inside a WAV file and instead embedded its encrypted payload inside what appeared to be a legitimate Microsoft NuGet package.

The underlying malware remained almost identical.

The wrapper changed.

That is an important defensive lesson.

Indicators such as:

COTFileReadApp.exe

or:

Canon Configuration Reader

are useful for immediate hunting, but attackers can replace them quickly.

Behavioral detection is considerably more durable.

A stronger detection model is:

PowerShell executes → downloads obfuscated script → PowerShell launches msiexec against a randomly named MSI in %TEMP% → signed application executes from an unusual directory under %LOCALAPPDATA% → unsigned or modified DLL is loaded beside it → Run key and scheduled task created with matching names → persistent process begins unusual outbound communications

That sequence remains suspicious even when the attacker replaces Canon with Stardock or changes every hash in the chain.

The campaign also highlights the growing abuse of search advertising for malware delivery.

Some victims reached the malicious Custom GPT after searching Google for ChatGPT and selecting a sponsored result.

This is particularly dangerous because users naturally assume that advertisements appearing above legitimate search results have undergone some level of validation.

Attackers are exploiting precisely that assumption.

Search-engine advertising has increasingly become part of the malware-delivery ecosystem because criminals can purchase visibility instead of waiting for victims to encounter phishing messages.

The user is actively searching for the product.

The attacker simply places themselves between the search and the legitimate destination.

The Custom GPT then adds another layer of credibility.

This represents a broader shift in social engineering.

Historically, attackers built fake websites that resembled trusted platforms.

Increasingly, they are abusing legitimate functionality inside the trusted platforms themselves.

A malicious Google document is still hosted on Google.

A malicious GitHub repository is still hosted on GitHub.

A weaponized shared AI conversation is still displayed through the AI provider.

A malicious Custom GPT is still hosted on ChatGPT.

This changes how users need to interpret trust.

A legitimate domain proves who operates the platform. It does not prove that every piece of user-generated content hosted on that platform is trustworthy.

That distinction will become increasingly important as AI services support more shared content, custom agents, plugins, artifacts, and public workflows.

Users accustomed to treating chatgpt.com as inherently trustworthy may not distinguish between an OpenAI model and a third-party Custom GPT built by an unknown community user.

The title “Plus 5.6” appears designed specifically to exploit that confusion.

Someone unfamiliar with Custom GPTs could reasonably believe they had opened a new official model.

This suggests that product-interface clarity itself has become part of platform security.

Users need to be able to distinguish unmistakably between:

official platform functionality

and:

third-party user-created content running inside the platform

The campaign also demonstrates why ClickFix remains so successful.

ClickFix attacks invert the usual malware-delivery model.

Instead of exploiting Windows to execute code, the attacker convinces the victim to execute the code voluntarily.

The command may be presented as a CAPTCHA fix, browser repair, Cloudflare verification, software update, security check, or troubleshooting instruction.

From an endpoint-security perspective, the process may initially look legitimate:

user launches PowerShell → user pastes command → PowerShell executes

The attack exploits human authorization rather than an operating-system vulnerability.

Security awareness should therefore include one extremely simple rule:

No legitimate CAPTCHA, Cloudflare verification, ChatGPT prompt, browser check, or website security test should require a user to open PowerShell, Command Prompt, Windows Run, or Terminal and paste a command.

That message is understandable to non-technical users and applies to a growing number of ClickFix variants.

For enterprises, PowerShell telemetry remains one of the strongest detection opportunities.

The campaign uses PowerShell to fetch scripts, execute them from temporary directories, and invoke msiexec.

Security teams should monitor for suspicious combinations such as PowerShell downloading content from numeric or unusual hosts, executing randomly named .ps1 files in %TEMP%, and spawning msiexec with silent-install arguments.

Signed binaries executing from unusual locations are another strong signal.

Canon or Stardock executables installed under unexpected user-writable directories should be investigated, particularly when launched immediately after MSI installation.

Application control can significantly reduce the effectiveness of this kind of malware.

Policies such as Windows Defender Application Control or carefully managed AppLocker rules can prevent users from executing unapproved software from temporary or user-writable locations even when social engineering succeeds.

Restricting unnecessary PowerShell execution for ordinary users can further reduce the ClickFix attack surface.

Endpoint detection should also look for persistence repair behavior.

A Run key or scheduled task that repeatedly reappears after deletion strongly suggests an active process maintaining persistence.

That should trigger process-level investigation rather than another round of deleting the same registry entry and expressing surprise when it returns.

The incident numbers also deserve careful interpretation.

Huntress says it responded to at least 40 incidents linked to the Google Sites domain used in the campaign, but only two were confirmed to have originated through the malicious Custom GPTs.

That means the Custom GPT technique is one entry point into a broader malware-delivery infrastructure, not necessarily the source of all 40 infections.

This distinction should remain clear because otherwise the scale of the Custom GPT abuse can easily be overstated.

The underlying infrastructure may be distributed through advertisements, direct links, other AI services, compromised websites, or additional mechanisms.

The Custom GPT is one particularly interesting delivery path.

It is not the entire campaign.

OpenAI removed the first malicious GPT after Huntress reported it, but the rapid appearance of another demonstrates the familiar moderation problem facing platforms that allow user-created content.

Attackers need only create another account or artifact.

The platform needs to identify and remove every malicious variation.

That creates the same asymmetry already seen with phishing pages, social-media accounts, malicious advertisements, and code repositories.

Automated platform defenses therefore need to examine not only uploaded files but also where user-created AI experiences attempt to redirect users and what actions they instruct users to perform.

A Custom GPT consistently directing users to external websites and telling them to run terminal commands should deserve far more scrutiny than one recommending restaurants or summarizing PDFs.

The broader cybersecurity lesson from this campaign is that AI platforms are becoming part of the social-engineering attack surface even when the AI model itself is not doing anything technically malicious.

The attacker does not need ChatGPT to write malware.

They need ChatGPT to look trustworthy.

That distinction is important.

The attack chain can be summarized as:

sponsored Google result → malicious Custom GPT on legitimate ChatGPT domain → fake service-availability message → attacker-controlled Google Sites page → fake Cloudflare verification → victim manually executes PowerShell → obfuscated script downloads MSI → signed application sideloads malicious DLL → encrypted loader and custom archive execute → RAT gains persistent remote access

The innovation is not a revolutionary new RAT.

It is the construction of an unusually convincing trust funnel leading to an established ClickFix technique.

Search engines provide visibility.

ChatGPT provides credibility.

Google Sites provides hosting.

Cloudflare branding provides familiarity.

Signed applications provide execution camouflage.

PowerShell and Windows provide the tools.

The attacker simply connects them.

That is why this campaign deserves attention beyond the individual malware family.

Modern attackers increasingly do not build every component themselves.

They assemble attacks from legitimate platforms, trusted brands, signed binaries, built-in operating-system tools, and one carefully placed malicious component.

Each piece appears normal in isolation.

The attack becomes visible only when defenders examine the context connecting them.

And that may be the most useful lesson from the malicious Custom GPT campaign:

A trusted platform can establish trust. It cannot automatically guarantee the trustworthiness of everything somebody builds on top of it.

Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]

Source: Custom ChatGPTs push ClickFix attacks to deploy RAT malware via Bleeping Computer — published 29 Sep 2026.