ChatGPT Custom GPTs Weaponized for ClickFix Malware Delivery

Introduction

The intersection of generative artificial intelligence and cybercrime has entered a dangerous new phase. In late September 2026, threat hunters at Huntress identified a sophisticated campaign leveraging the inherent trust users place in the ChatGPT ecosystem. By crafting malicious Custom GPTs masquerading as legitimate productivity tools, adversaries are funneling unsuspecting users toward compromised websites rigged with ClickFix social engineering traps. The endgame is the silent installation of a Remote Access Trojan (RAT), granting attackers persistent, hands-on-keyboard control over victim endpoints. This development signals a maturation in tactic: adversaries are no longer merely using AI to write phishing emails; they are weaponizing the AI platform itself as a delivery vector.

Anatomy of the Custom GPT Supply Chain Attack

The attack begins in the OpenAI GPT Store or via shared links, where threat actors publish Custom GPTs branded as helpful utilities—ranging from PDF summarizers and code debuggers to SEO analyzers and resume builders. These GPTs are configured with specific instructions that, when invoked by the user, generate responses containing malicious URLs. Unlike traditional phishing, the lure originates from within the trusted ChatGPT interface, complete with the platform's branding and SSL certificates, significantly lowering the victim's suspicion threshold.

Once the user clicks the provided link, they are redirected to a staged landing page. This infrastructure is designed to mimic legitimate verification pages—often imitating Cloudflare Turnstile checks, CAPTCHA challenges, or browser update prompts. This is the hallmark of the ClickFix technique: manipulating the user into copying and executing a malicious PowerShell command under the guise of fixing an error or proving they are human.

ClickFix: The Social Engineering Engine

ClickFix has rapidly become a favorite technique among initial access brokers because it bypasses traditional email security gateways and endpoint detection systems that scan for malicious attachments. The workflow is deceptively simple:

• The malicious site displays a fake error message (e.g., "Failed to load content," "Verification required," or "Clipboard error").
• A button labeled "Copy Fix" or "Run Verification" places a Base64-encoded PowerShell command into the user's clipboard.
• The user is instructed to press Win+R, paste (Ctrl+V), and hit Enter.
• The executed script downloads and stages the final payload—typically a RAT like AsyncRAT, Remcos, or a custom implant—directly into memory.

Because the user voluntarily executes the command, User Account Control (UAC) prompts are often bypassed or accepted willingly, and the process tree appears benign (explorer.exe -> cmd.exe -> powershell.exe), blending seamlessly with administrative activity.

The Payload: Remote Access and Persistent Espionage

The final stage observed in this campaign is a fully featured Remote Access Trojan. Once established, the implant provides the operator with a comprehensive toolkit: keystroke logging, screen capture, webcam/microphone access, file system browsing, credential harvesting from browsers and password managers, and lateral movement capabilities via SMB/WMI. Critically, the malware establishes persistence through scheduled tasks, registry run keys, or WMI event subscriptions, ensuring survival across reboots. Telemetry suggests the operators are conducting targeted espionage rather than opportunistic ransomware, with dwell times exceeding weeks before lateral expansion.

Why AI Platforms Are the New Watering Holes

This campaign fits a broader pattern observed throughout 2025 and 2026: the weaponization of trusted SaaS and AI platforms as "living off the land" infrastructure. Previous waves abused shared Google Docs, Notion pages, GitHub Gists, and Hugging Face Spaces to host payloads or command-and-control (C2) directives. Custom GPTs offer unique advantages: they are indexed by search engines, shareable via simple URLs, require no hosting maintenance by the attacker, and inherit the platform's high reputation scores. Furthermore, the natural language interface allows attackers to dynamically tailor lures based on user prompts, creating a conversational social engineering experience that static phishing pages cannot replicate.

Mitigation and Detection Strategies

Security teams should implement a layered defense posture tailored to this threat vector:

• Network Level: Block or alert on connections to newly registered domains (NRDs) and known ClickFix infrastructure patterns (e.g., specific URL paths like /verify, /fix, /clipboard).
• Endpoint Level: Deploy EDR rules detecting powershell.exe execution with -EncodedCommand or clipboard interaction APIs (Get-Clipboard, Set-Clipboard) initiated by non-system processes.
• Identity Level: Enforce Phishing-Resistant MFA (FIDO2/WebAuthn) to prevent credential reuse if the RAT harvests browser cookies or passwords.
• Policy Level: Restrict access to the GPT Store and third-party Custom GPTs via enterprise policy until a vetting process is established. Treat Custom GPTs as untrusted third-party software.

Conclusion

The weaponization of ChatGPT Custom GPTs for ClickFix-driven RAT deployment underscores a harsh reality: trust is the ultimate vulnerability. As AI platforms become ubiquitous productivity layers, they inherit the same risks as email, browsers, and document sharing—amplified by the veneer of intelligence and legitimacy. Defenders must assume that any interactive AI feature capable of rendering links or code will be abused. At Grivyonx Cloud, our AI-driven threat hunting platform continuously models these emerging abuse patterns, correlating platform-level telemetry with endpoint behavior to detect the subtle precursors of compromise—whether the lure comes from a phishing email, a shared document, or a seemingly helpful Custom GPT. Staying ahead requires not just better signatures, but a fundamental shift toward zero-trust interaction with AI-generated content.