Hackers Weaponize ChatGPT Custom GPTs for Malware Distribution
Threat actors are exploiting OpenAI's Custom GPT feature to impersonate AI tools and trick users into downloading malware, including a sophisticated remote access trojan.
Cybercriminals are actively abusing OpenAI's Custom GPT feature, transforming it into a potent tool for distributing malware. Researchers have identified a campaign where attackers create seemingly legitimate AI tools within ChatGPT's ecosystem to lure unsuspecting users into downloading malicious software, most notably a sophisticated remote access trojan (RAT).
The attack chain, dubbed "ClickFix" by researchers, begins with malvertising and fake verification prompts. Users searching for "ChatGPT" might encounter a sponsored search result leading to a convincing fake "chatgpt.com" domain. This redirects them to a Google Sites page designed to mimic a legitimate ChatGPT interface, often impersonating official models like "Plus 5.6." The lure then presents a "Service Availability Notice," directing users to a supposed backup site.
This backup site is another Google Sites page, masquerading as a ChatGPT and Cloudflare CAPTCHA verification screen. Instead of a genuine verification process, victims are prompted to execute a PowerShell command. This social engineering tactic exploits users' willingness to resolve perceived minor issues or complete verification steps, tricking them into running malicious code themselves. The command downloads an obfuscated PowerShell script that fetches and silently installs a malicious MSI package.
The MSI package, disguised as "Advanced Printer Configuration Reader," hides itself from standard program listings and installs in the user's AppData directory. It then leverages a legitimate, signed Canon executable (COTFileReadApp.exe) to perform DLL sideloading. This technique involves the legitimate program loading a malicious DLL from the same directory, allowing the malware to execute with the privileges of the signed application.
Further stages involve a custom loader that implements advanced evasion techniques, including an AMSI bypass, ntdll unhooking, and anti-virtual machine checks. This loader then extracts and executes encrypted malware code from a concealed archive. The final payload is a potent RAT capable of remote desktop access, capturing microphone and camera feeds, searching files, executing arbitrary code, and maintaining persistence through scheduled tasks and registry run keys.
Researchers have observed at least 40 incidents utilizing this infrastructure, with attackers quickly adapting. Following OpenAI's removal of an initial malicious GPT, a replacement emerged within days, using a different signed executable but delivering the same RAT. This highlights the dynamic nature of these attacks and the attackers' ability to pivot to other legitimate signed binaries to evade detection.
Security experts advise users to be extremely cautious of any AI service or verification page that requests the execution of commands in PowerShell, Terminal, or the Run dialog. Legitimate verification processes do not require users to interact with command-line interfaces. Defenders should focus on behavioral detection, looking for anomalies such as signed binaries executing from unusual locations, unexpected DLL loading, and suspicious PowerShell activity, rather than relying solely on specific application names.
The malicious "Plus 5.6" Custom GPT, distributed via sponsored Google ads, directs users to a fake Cloudflare CAPTCHA page that prompts them to execute commands in their terminal. This leads to the sideloading of a RAT, with the Huntress SOC responding to at least 40 incidents linked to this specific campaign. While OpenAI removed the initial GPT, attackers quickly deployed another, demonstrating the evolving nature of this threat.
This new report details a specific campaign dubbed 'ClickFix' that leverages custom GPTs to impersonate legitimate software and lure users into executing malicious PowerShell commands. The campaign has been active since at least September 25, with at least two incidents linked to a custom GPT instance, and OpenAI has since taken down the malicious GPTs. The attackers have also evolved their tactics, switching from an audio file loader to a Microsoft NuGet package for the second discovered GPT instance.
This new report details a specific campaign that combines the abuse of ChatGPT's CustomGPT feature with a ClickFix attack, disguised as a Cloudflare CAPTCHA, to deliver malware. The attackers impersonate legitimate product offerings and use sponsored search results to lure victims to malicious CustomGPTs, which then lead to the download of a trojanized MSI installer.
This new report details a specific campaign leveraging ChatGPT Custom GPTs, where attackers impersonate legitimate product offerings and employ "ClickFix" lures via Google Sites to deliver malware. The attack chain involves a malicious MSI installer that uses DLL sideloading to load shellcode, ultimately deploying a remote access trojan (RAT) payload. The campaign has already infected at least 40 users, highlighting a sophisticated evolution in AI-driven social engineering tactics.
This new report details how threat actors are specifically leveraging legitimate domains from OpenAI and Google to enhance the credibility of these malicious custom GPTs. This tactic aims to further deceive users into downloading payloads, potentially including Remote Access Trojans (RATs), by making the lures appear more trustworthy.