Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via Click Fix Lures

Summary: Huntress observed in late September 2026 that threat actors abused ChatGPT Custom GPTs, disguised as product offerings, to send victims to Google Sites links running ClickFix lures that delivered a malicious MSI installer and a RAT, infecting no less than 40 users. The chain sideloaded a rogue DLL through a legitimate Canon-signed binary, hid an encrypted loader in a .WAV file, bypassed AMSI, unhooked ntdll.dll, ran anti-VM checks, and resolved its C2 server via DNS-over-HTTPS through Cloudflare, Google, and Quad9 so lookups never appeared in local DNS logs.
Why it matters: The entry point was a sponsored Google result for "chatgpt" and a Custom GPT hosted on the legitimate ChatGPT site, and the RAT's DNS-over-HTTPS lookups to well-known resolvers mean this traffic never shows up in your local DNS logs.

Read the original at The Hacker News ↗

Topics: Malware
Related: ARTEX and beyond: AI-enabled penetration testing platforms Cyber Risks · Nov 13, 2026
Fake GTA 6 download goes after Steam logins and crypto wallet data Cyber Risks · Nov 13, 2026
Operation Endgame Takes Down Gootloader, CastleRAT and StealC Servers, Seizes 6.4M Stolen Logins Cyber Risks · Nov 13, 2026