Malicious Custom GPTs Weaponized for RAT Delivery via ClickFix Tactics

Introduction

The intersection of generative AI and cybercrime has entered a dangerous new phase. Threat actors are now weaponizing OpenAI's Custom GPT functionality to orchestrate ClickFix-style social engineering campaigns that deliver remote access trojans (RATs) to unsuspecting victims. By leveraging the inherent trust users place in legitimate AI platforms and trusted domains like chatgpt.com and google.com, these attacks bypass conventional security awareness training and technical controls alike.

This isn't merely a theoretical risk — active campaigns have been observed in the wild, combining the persuasive power of conversational AI with the proven effectiveness of ClickFix tactics. The result is a delivery mechanism that feels helpful, authoritative, and entirely benign until the payload executes. For security teams, this represents a fundamental shift in how AI platforms can be abused: not just to generate phishing content, but to serve as the delivery infrastructure itself.

How the Attack Chain Operates

The campaign follows a carefully engineered sequence designed to exploit both technical trust and human psychology:

• Custom GPT Creation: Attackers build purpose-specific GPTs within OpenAI's platform, configuring them to impersonate technical support, system diagnostics, or AI-enhanced troubleshooting assistants.
• Legitimate Domain Abuse: Because these GPTs reside on chatgpt.com, they inherit the domain's reputation, SSL certificates, and brand trust — making URL filtering and domain-based allowlists ineffective.
• ClickFix Lure Deployment: The GPT engages users with a fabricated technical issue — often a "corrupted cache," "sync error," or "verification failure" — and provides step-by-step "fix" instructions.
• PowerShell Execution: Victims are instructed to open a terminal and run a PowerShell command, typically obfuscated, that downloads and executes a RAT payload from attacker-controlled infrastructure.
• Persistence and Control: Once installed, the RAT establishes command-and-control communication, granting attackers persistent access, keystroke logging, credential harvesting, and lateral movement capabilities.

What makes this particularly insidious is the conversational nature of the trap. Unlike static phishing pages, a Custom GPT can adapt its language, answer follow-up questions, and build rapport — effectively social engineering at scale with dynamic, context-aware responses.

Why Traditional Defenses Fall Short

This attack vector exposes critical gaps in conventional security stacks:

• Domain Reputation Systems: Since the malicious interaction occurs on chatgpt.com, allowlists and reputation-based filtering see only legitimate traffic.
• Email Security Gateways: No email is involved — the lure lives entirely within the AI platform, bypassing SPF, DKIM, DMARC, and sandbox analysis.
• Endpoint Detection: The initial PowerShell command often uses living-off-the-land binaries (LOLBins) and heavy obfuscation, evading signature-based AV and even some behavioral analytics.
• User Awareness Training: Most training focuses on email phishing, suspicious links, and attachment handling. Few programs cover "an AI assistant told me to run this command" scenarios.

Organizations relying on perimeter-centric or signature-dependent defenses are effectively blind to this threat until post-exploitation activity triggers an alert — often too late.

Broader Implications for AI Platform Security

This campaign signals a maturation in how threat actors view AI platforms: not as targets, but as infrastructure. The same properties that make Custom GPTs powerful — accessibility, customization, trusted hosting, natural language interaction — make them ideal for abuse. We can anticipate several evolutions:

• Multi-Stage Payloads: GPTs that deliver staged loaders, each step validated through continued conversation.
• Credential Phishing Hybrids: Combining ClickFix execution with fake OAuth prompts hosted on Google domains.
• Supply Chain Targeting: Malicious GPTs shared publicly or via marketplace, targeting developers, analysts, or specific industries.
• Cross-Platform Replication: Similar abuses on other LLM platforms with custom agent/bot frameworks (Anthropic, Google Gemini, Microsoft Copilot Studio).

Platform providers face a profound challenge: maintaining the openness that drives innovation while implementing guardrails that prevent weaponization. Content moderation at inference time, behavioral analysis of GPT interactions, and stricter publishing controls for custom agents will likely become necessary.

Conclusion

The weaponization of Custom GPTs for RAT delivery marks a clear inflection point: AI platforms have graduated from being tools that assist attackers to becoming active participants in the kill chain. Defending against this requires more than patching or blocking — it demands a rethinking of trust boundaries, user behavior monitoring, and the security architecture surrounding generative AI interactions. As these campaigns grow in sophistication, the organizations that adapt their detection strategies to account for AI-mediated social engineering will be the ones that stay ahead of compromise. Grivyonx Cloud's AI-driven threat detection and automated response capabilities are designed to identify and neutralize these emerging attack vectors by correlating anomalous user behavior with real-time threat intelligence across your digital estate.