Image: cdn.builder.io · rights & removal

Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

Reporting by Huntress LabsRead the original at huntress.com

Executive Summary

Threat actors are exploiting the legitimate Custom GPT feature of ChatGPT to conduct social engineering attacks. Attackers lure victims by creating a Custom GPT that responds with a message directing them to a Google Sites link, which initiates a ClickFix attack designed to force users to execute a malicious command in their terminal. This command downloads and executes an MSI installer, which then uses a legitimate, Canon-signed application to sideload a malicious DLL, facilitating evasion of security measures. The attack chain involves multiple stages: initial lure via search results, execution of a ClickFix script, installation of the payload through an obfuscated MSI, and subsequent unpacking of a Remote Access Trojan (RAT) from an encrypted file system within memory. Subsequent analysis revealed that the entire process involved complex steganography within audio files to hide shellcode, which ultimately delivered a full-featured RAT capable of remote control, screen capture, and file system navigation across the host.

Facts Only

Special thanks were given to Tanner Filip, Camilo Lima, Ethan Williams, Ryan Eisenhower, Jose Oregon, Jai Minton, Susannah Matt, and Lindsey Welch for contributions to the investigation.
Attackers used a Custom GPT instance as a lure.
The lure involved a Google Sites link that delivered a ClickFix attack.
The ClickFix attack led to the download and execution of a malicious MSI installer.
The MSI deployed a legitimate, Canon-signed application (COTFileReadApp.exe) to sideload a malicious DLL.
The infection chain involved PowerShell executing an obfuscated script to download and run an MSI.
The MSI installed persistence mechanisms named "Canon Configuration Reader" via a Run key and a scheduled task.
The payload included shellcode decoded from encrypted WAV files, which executed AMSI bypass techniques.
The final stage involves unpacking an encrypted file system archive (monitor.raw) containing a RAT.
The RAT capabilities include remote desktop sessions, screen broadcasting, camera/microphone capture, and file system search across the host.
Indicators of Compromise include specific filenames and hashes related to loaders, DLLs, and the RAT components.

Full Take

The consistent evolution of this threat highlights a critical vulnerability: the systemic trust placed in legitimate, interactive AI features for social engineering is being weaponized against users. The progression from exploiting a Custom GPT lure to utilizing Google Sites for a ClickFix attack demonstrates an understanding of leveraging layered platforms—AI services, search engine advertising, and public website hosting—to create a multi-stage deception that bypasses single-point security controls. The analysis of the malware chain reveals a deliberate focus on evading automated detection; the use of steganography in audio files for shellcode delivery and the creation of custom, dynamically named persistence mechanisms points toward an actor group operating with modular, adaptable tooling rather than static malware. This pattern suggests a mature campaign where the core malicious functionality (the RAT) remains consistent, while the delivery mechanism—the "costume" involving host software substitutions like Canon versus Stardock applications and evolving steganographic methods—is continuously refreshed to evade signature-based defenses. The ultimate implication is that resilience requires looking beyond known malware signatures to analyze the architectural flow of trust across digital services.
Bridge Questions: How can defensive strategies shift focus from blocking known attack signatures to monitoring the behavioral sequences within legitimate application interactions? What systemic changes are needed in how AI platforms manage and secure user-generated custom content? How can institutions establish real-time correlation across disparate platform telemetry to anticipate multi-stage social engineering attacks?

From the original · Huntress Labs

Acknowledgements: Special thanks to Tanner Filip, Camilo Lima, Ethan Williams, Ryan Eisenhower, Jose Oregon, Jai Minton, Susannah Matt, and Lindsey Welch for their contributions to this investigation and writeup.

Read the full story at huntress.com

Sentinel — Human

Confidence

The text presents a highly detailed forensic breakdown of a sophisticated cyberattack chain exploiting AI platform features. The structure demonstrates deep technical expertise typical of threat intelligence reporting, rather than generic AI-generated synthesis.

Signals Detected

High lexical diversity mixed with highly technical, specific procedural detail and narrative flow.

Strong, logical progression tracing a complex cyberattack chain, backed by internal consistency among technical steps and payload descriptions.

Extensive use of detailed, multi-stage forensic breakdown (layers 1 through 7) with specific file names, hex values, and code analysis, suggesting deep, proprietary investigation.

Specific, verifiable technical artifacts (file structures, XOR algorithms, timestamps, named malware components) are presented with the structure of a forensic report. The high volume of specific IOCs is typical of deep threat intelligence work.

Human Indicators

The transition between narrative explanation (the social engineering lure) and deep, granular technical disassembly (Stages 1 through 7) indicates a human analyst synthesizing complex findings.

The inclusion of specific artifacts like hash structures, XOR key derivation, and the detailed analysis of DLL sideloading strongly suggests direct involvement from malware reverse engineering or incident response expertise.