Hackers are using malicious custom ChatGPT bots to spread RAT malware

Security researchers at Huntress uncovered a malicious custom GPT, named "Plus 5.6," hosted directly on OpenAI's chatgpt.com domain and used to trick users into installing remote access malware.

• The lure: a fake GPT named to resemble a legitimate ChatGPT model or upgrade.
• The discovery path: some victims reached it through a sponsored Google search result for the word "chatgpt."
• The payload: a full remote access trojan capable of taking control of an infected machine.

The catch: because the GPT lived on OpenAI's own legitimate domain, standard phishing red flags, like checking a URL for a lookalike domain, wouldn't have caught it.

The attack follows a ClickFix-style pattern, a social engineering technique that shows victims a fake service notice instructing them to run a command to fix a supposed problem.

When a user interacted with "Plus 5.6," it responded with a fake "Service Availability Notice" claiming limited access on the primary domain, then directed users to a Google Sites page presented as a "backup domain" to continue.

That Google Sites page then displayed another fake security check, instructing visitors to run a PowerShell command supposedly needed to verify their access.

Running that PowerShell command triggers a multi-stage infection chain. It downloads a malicious MSI installer that abuses a legitimate, Canon-signed executable to sideload a malicious DLL, ultimately deploying the actual malware payload.

By the numbers: the resulting remote access trojan gives attackers a substantial set of capabilities once installed, including remote desktop control, audio and camera capture, file searching, host reconnaissance, and the ability to execute additional payloads on the infected system.

For persistence, the malware creates both a registry Run key and a scheduled task, both deliberately named "Canon Configuration Reader" to blend in with legitimate printer or scanner software a victim might genuinely have installed.

Huntress identified at least 40 related incidents tracing back to the malicious infrastructure, with at least two separate confirmed custom GPT variants involved in spreading the attack. That's a modest number in absolute terms, but it represents confirmed, investigated infections rather than a theoretical vulnerability, meaning real people had their machines compromised through what looked like an ordinary interaction with a ChatGPT tool.

OpenAI removed the first identified malicious GPT by September 25, 2026. However, a second variant reportedly remained active for several days afterward, according to Huntress's findings, meaning the removal process didn't fully close the door on the same attack pattern immediately.

Looking further ahead: OpenAI has separately announced plans to retire custom GPTs entirely, with a stated deadline of December 11, 2026. That broader change, unrelated specifically to this malware campaign, would eventually eliminate the exact attack surface this particular scheme relied on, though it leaves a multi-month window during which similar abuse remains possible.

The technique behind this attack, tricking users into pasting and running a malicious command themselves, first appeared in late 2023 and early 2024, typically disguised as a fake CAPTCHA check or browser update notice.

How fast it's grown since then: security firm ESET reported a roughly 500% rise in ClickFix detections between late 2024 and mid-2025, and Microsoft has said the technique accounted for as much as 47% of initial network access incidents it tracked in one recent report. State-sponsored hacking groups from North Korea, Iran, and Russia have all adopted the technique in their own operations over the same period, alongside financially motivated criminal groups.

That rapid growth is exactly why security researchers have been watching for ClickFix showing up in new contexts, like AI platforms, rather than staying confined to the fake-CAPTCHA pages where it first became common. This campaign represents the technique adapting to wherever it can find a plausible-looking pretext, in this case, a ChatGPT-branded tool millions of people already trust by default.

The core danger of this specific campaign isn't the ClickFix technique itself, which security researchers have documented across many different platforms and contexts. It's specifically that the malicious GPT lived on chatgpt.com, a domain users have every reason to trust by default.

Most phishing awareness training centers on checking whether a URL looks legitimate before trusting it. This attack sidesteps that entire defense, since the URL genuinely was legitimate, OpenAI's own domain, right up until the point a user got redirected off it to the actual malicious Google Sites page. That's a meaningfully harder attack pattern for typical security awareness training to catch.

This isn't the first time a platform hosting user-generated AI tools has faced this kind of abuse, and it's unlikely to be the last. App stores and browser extension marketplaces have dealt with similar dynamics for years: legitimate-seeming, platform-hosted content that turns out to be malicious, requiring constant moderation rather than a one-time fix.

Why that comparison matters: as more platforms let users build and share custom AI tools, whether GPTs, plugins, or agent configurations, the same trust exploitation becomes available to attackers targeting any of them, not just OpenAI specifically. Platform-level trust, once established, becomes exactly the kind of asset attackers look to borrow rather than build themselves.

OpenAI's planned December 11 retirement of custom GPTs isn't a response to this security incident specifically. It reflects a broader architectural shift the company had already been planning: rather than maintaining separate, standalone specialized versions of ChatGPT, OpenAI wants a single ChatGPT experience with a reusable toolbox of skills and connections that can be called on as needed.

What that means practically: custom GPTs are being replaced by a plugin-based architecture combining reusable skills, reference files, connected apps, and optional tool integrations. Existing GPT creators can migrate their instructions and knowledge files into this new plugin format, though sharing settings and user access reportedly don't carry over automatically, and some builders have raised concerns that plugins don't fully replicate the predictable, self-contained environment a dedicated custom GPT provided.

That transition happens to close off this specific attack vector as a side effect, but it wasn't designed as a security fix, meaning similar abuse patterns could plausibly resurface within whatever replaces custom GPTs if the new plugin system isn't moderated with this exact kind of impersonation in mind from the start.