Malicious GPT Lures Funnel Victims Into Advanced Remote-Control Malware
Threat actors are abusing attacker-created Custom GPTs hosted on the legitimate ChatGPT domain to redirect users into a sophisticated ClickFix campaign that ultimately installs a full-featured remote access trojan (RAT).
Huntress identified two malicious GPTs connected to the operation and investigated at least 40 incidents associated with the campaign. Two infections were directly confirmed to have originated from a Custom GPT lure.
The attack demonstrates how adversaries can weaponize trusted online platforms without compromising the platforms themselves.
Legitimate ChatGPT Pages Establish Trust
Victims searching Google for ChatGPT encountered sponsored results leading to an attacker-created GPT presented as “Plus 5.6.”
Fake Service Failure Redirects Users
When users interacted with the GPT, it claimed the primary service was experiencing availability problems and directed them toward a supposed backup site hosted through Google Sites.
That page displayed a fake Cloudflare verification process using ClickFix, instructing victims to copy a command into Windows Run.
Executing it launched PowerShell and initiated the malware chain.
Eight Stages Hide the Final Payload
The infection chain uses multiple layers of obfuscation to complicate detection and analysis.
PowerShell Silently Deploys a Malicious MSI
The initial command retrieves an obfuscated PowerShell script, which silently installs a malicious MSI.
Attackers also represented the delivery server using a decimal-form IP address, potentially bypassing security controls designed primarily to recognize conventional dotted IPv4 addresses.
Signed Applications Enable DLL Sideloading
The malware initially abused a legitimately signed CanonCOTFileReadApp.exe application.
A modified DLL placed beside the trusted executable causes Windows to load attacker-controlled code through DLL sideloading.
A later campaign variant replaced the Canon component with a legitimately signed Stardock executable, while leaving the underlying RAT essentially unchanged.
Encrypted Payloads Conceal the Infection
Attackers added several layers between initial execution and the final malware.
Malicious Code Hides Inside Innocent-Looking Files
One variant concealed an encrypted loader inside a valid-looking WAV audio file.
The loader subsequently opened monitor.raw, a custom encrypted archive containing 315 folders and 806 files, including persistence components and the final RAT.
The later Stardock variant moved its loader into a genuine Microsoft NuGet package instead, demonstrating the campaign's ability to rapidly change its concealment strategy.
RAT Provides Extensive Surveillance Capabilities
Once installed, the implant gives operators broad control over the compromised Windows endpoint.
Browser, Camera and Desktop Data Become Accessible
Huntress found capabilities for remote desktop control, screen capture, camera and microphone surveillance, filesystem searches and access to information from 17 browsers.
The RAT can also download and execute additional payloads in multiple formats.
Command-and-control discovery uses DNS-over-HTTPS through services including Cloudflare, Google and Quad9, helping conceal DNS activity inside encrypted HTTPS traffic.
Behavior Matters More Than File Names
The attackers' rapid transition from Canon to Stardock demonstrates why detections based solely on filenames or specific signed applications are fragile.
Defenders should instead watch for behavioral combinations such as PowerShell launching silent MSI installations from temporary directories, signed applications executing from unusual user-writable locations, DLL sideloading and paired Run-key/scheduled-task persistence.
The campaign highlights an emerging security problem: attackers do not need to compromise a trusted AI service when they can exploit its credibility to persuade users to compromise themselves.