ChatGPT Scam Exploits Custom GPTs to Deploy Remote Access Trojan Malware on Windows Systems

Custom GPTs Weaponized in New ChatGPT Scam Campaign

Cybersecurity researchers at Huntress have uncovered a sophisticated ChatGPT scam that exploits the platform's Custom GPT feature to distribute malware2

2

. The campaign affected dozens of users, with investigators responding to at least 40 incidents connected to the malicious infrastructure5

5

. Attackers created a malicious custom GPT named Plus 5.6, designed to mimic OpenAI's official model naming conventions like GPT-3.5 and GPT-5 Pro5

5

. What makes this social engineering attack particularly dangerous is that Custom GPTs are hosted on the legitimate ChatGPT.com domain, lending immediate credibility to the operation and increasing the likelihood victims will follow malicious instructions2

2

.

How the ClickFix Attack Chain Operates

The attack begins when users search for ChatGPT on Google and click on sponsored Google links that appear above authentic search results1

1

. Once victims interact with the Plus 5.6 Custom GPT, they receive a Service Availability Notice regardless of what they type, claiming limited availability on the primary domain3

3

. The message presents two options: upgrade to a Plus subscription or navigate to a backup domain, with the notice recommending immediate access through the backup option3

3

. This backup domain is hosted on Google Sites, another trusted platform that attackers leverage to appear legitimate2

2

. The Google Sites page displays fake Cloudflare checks that employ ClickFix attacks, deceiving users into copying and executing malicious PowerShell commands in Windows3

3

. Roman Oliinyk, CEO of PayCore Media, Inc., emphasized that a real Cloudflare check would never ask users to do anything on their keyboard beyond checking a box or pressing a button1

1

.

Remote Access Trojan Malware Capabilities

Executing the PowerShell command initiates installing malware through a malicious MSI installer that launches a legitimate, signed application and a modified DLL loading the payload2

2

. The payload is a remote access trojan with extensive capabilities including remote desktop access, audio and camera capture, file searches, host reconnaissance, and running additional payloads2

2

. The RAT malware can view screens, search files, use webcams and microphones, capture system audio, and install more malware4

4

. It documents installed antivirus software, Microsoft Defender status, and system profiles while recognizing 17 web browsers and launching the default one3

3

. For persistence, the malware creates a new Run key in the Windows Registry and a scheduled task, both named Canon Configuration Reader2

2

.

Advanced Evasion and Encryption Techniques

The attack chain demonstrates sophisticated technical implementation across multiple stages. Huntress researchers highlighted phase 6, noting attackers built a custom encrypted file system to conceal the persistence script and RAT malware2

2

. Instead of one encrypted blob, it's a custom archive with its own folder tree, essentially a homemade encrypted zip file starting with a small header, followed by an index of 1,128 entries recording parent folders, sizes, and per-file keys, with file contents packed consecutively2

2

. The RAT uses DNS-over-HTTPS through Cloudflare, Google, and Quad9 servers to find its command-and-control server, with lookups traveling inside ordinary HTTPS traffic to well-known resolvers so they never appear in local DNS logs3

3

. The loader shellcode bypasses AMSI, unhooks ntdll.dll to sidestep user-mode monitoring by security programs, and runs anti-virtual machine checks by examining CPU vendor strings against various VMware, VirtualBox, Hyper-V, QEMU, Xen, and Parallels drivers and services3

3

.

Evolving Campaign and Platform Response

OpenAI took down the first malicious custom GPT by September 25, but researchers discovered a second GPT linked to the same campaign on September 27 that remained active when they published their report2

2

. More recent attacks switched from a Canon-signed host application to a Stardock-signed one and changed how they concealed and delivered the loader, although the payload remained the same2

2

. OpenAI plans to retire Custom GPTs on December 112

2

. The campaign represents part of a broader trend where threat actors continue turning trusted platforms into convincing entry points for social engineering attacks, whether via ChatGPT's Custom GPT feature or through Google Sites for hosting ClickFix attacks3

3

. Most of the infection chain runs in memory or is supported by files that appear benign, allowing defenders to implement detections based on process activity monitoring2

2

. Users should type ChatGPT.com directly into browsers instead of searching for it, avoid clicking sponsored Google links, and never paste and run commands on computers unless certain of their function1

1

.