> ## Content Index > Fetch the complete content index at: https://f4n6.co.uk/llms.txt > Use this file to discover other available public pages before exploring further. # Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix - URL: https://f4n6.co.uk/security-feed/attackers-abuse-chatgpt-custom-gpts-to-deliver-rat-via-clickfix/ - Published: 2026-09-29T08:47:24.000Z - Updated: 2026-09-29T08:47:24.000Z - Author: Jeff Davies - Tags: #security-feed ## 1\. Executive summary Attackers are using attacker-built Custom GPTs on the legitimate chatgpt\[.\]com domain to serve ClickFix lures that lead to a malicious MSI installer and a DLL-sideloaded remote access trojan. Huntress reports at least 40 SOC incidents tied to the specific Google Sites domain in this campaign, with two confirmed to have arrived through a Custom GPT instance. The lure is amplified by paid Google Ads that place the Custom GPT page above organic results, so a user searching for "chatgpt" can land on the attacker page directly. The first Custom GPT was taken down on 25 September 2026, but a second linked to the same campaign was still active on 27 September, so the technique is not closed out. EMEA financial services exposure is indirect but real: the vector is a trusted AI platform and a signed third-party binary, both of which sit inside typical allow-lists. ## 2\. Regulatory framing No specific DORA/NIS2 article is directly engaged by this item. The source describes a social-engineering and malware-delivery technique observed across dozens of consumer and enterprise endpoints; it does not describe an incident at a named financial entity, a third-party ICT provider relationship, or a supply-chain compromise of a service a client consumes. Mapping DORA Art. 17 or NIS2 Art. 23 here would be a generic fit that applies to any malware campaign and would not change what a client must do. The one fact worth flagging for internal process is that the payload is a legitimate Canon-signed binary, which is relevant to application allow-listing and third-party software inventory, but the source does not establish a contractual or concentration relationship that would engage DORA Art. 28, 29 or 30. ## 3\. Technical analysis & attack chain Confirmed steps, as reported by Huntress: 1. A victim searches Google for "chatgpt" and clicks a sponsored result. The ad carries Google Ads click-tracking parameters (`gad_source`, `gad_campaignid`, and a click ID), which Google appends on paid-ad clicks. The ad places the attacker page above organic results. 2. The victim lands on a Custom GPT page hosted on the legitimate chatgpt\[.\]com domain. The page title is "Plus 5.6", chosen to be mistaken for a real ChatGPT model, with the builder shown underneath as a "community builder". 3. The Custom GPT is programmed to return a single message to any prompt: a "Service Availability Notice" claiming the service is "experiencing limited availability on the primary domain" and instructing the user to upgrade or continue via a supplied link. 4. The message contains a Google Sites link. That link leads to a ClickFix-style attack, which instructs the user to run a command or paste content that results in download and execution of a malicious MSI installer. 5. The MSI installer deploys a legitimate, Canon-signed application, `COTFileReadApp.exe`. 6. The signed Canon binary is abused to sideload a malicious DLL, which is the RAT payload. Sideloading through a signed binary is the detection-evasion step. The source does not give the MSI filename, the sideloaded DLL name, the DLL search path, the RAT family name, C2 addresses, persistence mechanism, privilege-escalation step, lateral-movement behaviour, or exfiltration detail. Those specifics are absent from the material provided and are not inferred here. Scale and takedown timeline: Huntress's SOC responded to at least 40 incidents stemming from the specific Google Sites domain in this campaign, and confirmed two of those arrived through a Custom GPT instance. Huntress reported the first Custom GPT to OpenAI and it was taken down as of 25 September 2026\. On 27 September 2026, Huntress found a new Custom GPT linked to the same campaign, still active at publication. Confidence caveats. This is a single-source report (Huntress). The 40-incident figure, the two Custom GPT-attributed incidents, and the attribution of the second Custom GPT to the same campaign all rest on that one vendor's telemetry and are not independently corroborated here. No threat actor is named in the source, so there is no attribution to assess. The exact ClickFix command text, the MSI and DLL filenames, and the RAT family are not in the source; do not treat the absence as evidence they do not exist, and do not fill them in from other campaigns. ## 4\. Mitigation & containment P1 (within 24h) - Block the two known Custom GPT URLs at the web proxy or DNS layer if your policy permits blocking chatgpt\[.\]com paths: `hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6` and `hxxps://chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6`. The first was taken down on 25 September; the second was still active on 27 September. Treat the second as live until confirmed otherwise. - Block or alert on the Google Sites domain used as the ClickFix landing page. The source does not publish the domain string, so pull it from your own proxy logs by correlating Google Sites referrals from chatgpt\[.\]com in the campaign window (late September 2026 onward). - Hunt for execution of `COTFileReadApp.exe` outside its expected Canon install path. This is the sideload host; any instance launching from a user-writable directory (Downloads, Temp, AppData) is a P1 lead. - Search EDR telemetry for MSI installs (`msiexec.exe`) spawned from a browser process in the same window as a chatgpt\[.\]com or Google Sites visit. P2 (within 72h) - Add a detection rule for DLL sideloading against `COTFileReadApp.exe`: alert when the process loads a DLL from a directory other than its own install directory, or when the loaded DLL is unsigned while the host binary is Canon-signed. - Review application allow-listing policy. The campaign relies on a signed, legitimate binary passing allow-list checks. Where allow-listing is signature-based only, add path and parent-process constraints for signed third-party utilities. - Block Google Ads click-through to chatgpt\[.\]com Custom GPT paths at the proxy if your user population does not need Custom GPT access. This removes the ad-amplified entry point without blocking ChatGPT itself. P3 (within 7 days) - Add user-facing guidance that a Custom GPT page shows a builder profile under the title, and that a "Service Availability Notice" asking the user to run a command or install an update is not a ChatGPT system message. This is awareness, not a control; do not rely on it alone. - Add the campaign to retrospective hunting: query proxy logs for chatgpt\[.\]com `/g/g-` paths with `gad_source` parameters, and for Google Sites referrals from those sessions, going back to late September 2026. The source names no vendor patch or version fix, because the abused components (Custom GPT, Google Sites, the Canon binary) are legitimate and not vulnerable in the CVE sense. There is nothing to patch here; the controls are blocking, allow-list tightening, and sideload detection. ## 5\. Indicators of compromise | type | value | confidence | source | | -------- | --------------------------------------------------------------------- | ----------------------------- | -------- | | url | hxxps://chatgpt\[.\]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 | high (taken down 25 Sep 2026) | Huntress | | url | hxxps://chatgpt\[.\]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6 | high (active 27 Sep 2026) | Huntress | | filename | COTFileReadApp.exe | high | Huntress | | string | Plus 5.6 | medium (lure title, reusable) | Huntress | | string | Service Availability Notice | medium (lure text, reusable) | Huntress | The Google Sites landing domain is referenced in the source but not published as a string, so it is not listed. No hashes, IPs, C2 domains, or registry keys are present in the source material. ```iocs url hxxps://chatgpt[.]com/g/g-6ab595ad6554819181b686d4876efb80-plus-5-6 url hxxps://chatgpt[.]com/g/g-6ab6ba039440819185ed491740b11cf8-plus-5-6 filename COTFileReadApp.exe string Plus 5.6 string Service Availability Notice ``` Behavioural indicators | behaviour | where to observe | confidence | | ------------------------------------------------------------------------------------------------- | ------------------------------- | ---------- | | Browser session to chatgpt\[.\]com /g/g- path carrying gad\_source and gad\_campaignid parameters | web proxy, DNS, browser history | high | | Referral from chatgpt\[.\]com to a Google Sites page in the same session | web proxy | high | | msiexec.exe spawned from a browser process shortly after the above | EDR process telemetry | medium | | COTFileReadApp.exe executing from a user-writable path | EDR process telemetry | high | | COTFileReadApp.exe loading an unsigned DLL from outside its install directory | EDR image-load telemetry | medium | ## 6\. Detection The source gives usable artefacts: the lure title, the lure message text, and the sideload host binary name. The YARA rule targets the lure strings and the sideload host name as they would appear in a downloaded lure page, an MSI, or a dropped file. The Sigma rule targets the sideload behaviour. ```yara rule AT_ChatGPT_ClickFix_Lure_Indicators { meta: author = "Adverse Trace" date = "2026-09-29" reference = "https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat" description = "Detects lure strings and the sideload host binary name from the ChatGPT Custom GPT ClickFix campaign" strings: $lure_title = "Plus 5.6" ascii wide $lure_notice = "Service Availability Notice" ascii wide $lure_avail = "experiencing limited availability on the primary domain" ascii wide $sideload_host = "COTFileReadApp.exe" ascii wide condition: 2 of them } ``` ```yaml title: Canon COTFileReadApp.exe DLL Sideloading id: 8f3c1a2e-4b7d-4e9a-9c21-6d5e0a7b3f14 status: experimental description: Detects the Canon-signed COTFileReadApp.exe loading a DLL from a user-writable directory, the sideloading step in the ChatGPT Custom GPT ClickFix campaign. author: Adverse Trace date: 2026-09-29 references: - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat logsource: category: image_load product: windows detection: selection_image: Image|endswith: '\COTFileReadApp.exe' selection_path: ImageLoaded|contains: - '\Downloads\' - '\Temp\' - '\AppData\' - '\Users\Public\' condition: selection_image and selection_path falsepositives: - Legitimate Canon software installed to a non-standard path level: high ``` ## 7\. Sources - Huntress, "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix", https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat, 2026-09-28. ## 8\. Adverse Trace position This is a medium-severity social-engineering and malware-delivery technique, not a vulnerability with a CVSS score, and we are not inflating it into one. The impact when it lands is a RAT on an endpoint, which is serious, but the entry point is user action and the controls are blocking, allow-list tightening, and sideload detection rather than patching. The report is single-sourced from Huntress, so the 40-incident figure and the Custom GPT attribution should be treated as vendor telemetry pending corroboration; we will watch for a second independent report before raising the assessment. We assess that the technique will persist because the first Custom GPT was replaced within two days, and because the payload rides a signed Canon binary that most allow-lists accept. We will track the second Custom GPT URL for takedown status, and we will update this advisory if the MSI or DLL filenames, the RAT family, or the Google Sites domain become public, since those are the pivots clients need for retrospective hunting. Clients who see `COTFileReadApp.exe` running from a user-writable path should treat it as a confirmed compromise lead and contact us. --- [Read the original source →](https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat?ref=f4n6.co.uk) *Published via PulseTrace — Adverse Trace threat intelligence.*