Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix | Huntress

MITRE Techniques

• [T1204.001 ] User Execution: Malicious Link – Victims were lured through a sponsored result and Custom GPT prompts to click through to the malicious chain (‘a sponsored result then led them to the Custom GPT page’; ‘that link then brought them to a Clickfix-style attack’).
• [T1059.001 ] Command and Scripting Interpreter: PowerShell – The attack used PowerShell to download, stage, and execute the next payload (‘The ClickFix attack kickstarts the rest of the attack and leads to the execution of the following PowerShell command’).
• [T1105 ] Ingress Tool Transfer – The script downloaded the MSI from a remote server and retrieved additional components (‘downloads the MSI from the same decimal-IP host’).
• [T1218.007 ] System Binary Proxy Execution: Msiexec – The MSI was installed silently using msiexec to blend in with normal system behavior (‘installs it silently with msiexec /qn /norestart’).
• [T1574.001 ] Hijack Execution Flow: DLL Search Order Hijacking – The Canon and Stardock executables loaded malicious DLLs from their own folders (‘Windows checks the program’s own folder first’; ‘that’s DLL sideloading’).
• [T1574.002 ] Hijack Execution Flow: DLL Side-Loading – A signed Canon/Stardock binary was abused to load patched DLLs that pulled in the next stage (‘the attackers used [the host process]’; ‘loaded its logger, rdCore.dll came along for the ride’).
• [T1547.001 ] Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder – Persistence was maintained with an HKCU Run key named Canon Configuration Reader or Stardock DeElevation Tool (‘writes the HKCU Run key’; ‘the Run value’).
• [T1053.005 ] Scheduled Task/Job: Scheduled Task – The malware used a scheduled task for persistence and self-restoration (‘a scheduled task’; ‘re-creates it if it’s gone’).
• [T1027 ] Obfuscated Files or Information – Scripts, strings, and payloads were heavily obfuscated with integer arrays, XOR, and encrypted storage (‘one array of 3,036 negative integers’; ‘decoded with a rolling single-byte XOR’).
• [T1140 ] Deobfuscate/Decode Files or Information – Multiple stages decoded hidden scripts and machine code before execution (‘reimplemented its decryption’; ‘the noise turns into x64 machine code’).
• [T1027.004 ] Obfuscated Files or Information: Compile After Delivery – A malicious loader was embedded inside a normal-looking .wav file and a NuGet package (‘Common.Integrator.Preview.wav holds up to a quick look’; ‘Build.dat in a standard zip tool’).
• [T1497.001 ] Virtualization/Sandbox Evasion: System Checks – The loader and RAT checked for VM-related artifacts and behavior (‘Anti-VM checks against CPU vendor strings and a long list of VMware, VirtualBox, Hyper-V, QEMU, Xen and Parallels drivers and services’).
• [T1562.001 ] Impair Defenses: Disable or Modify Tools – The payload attempted to bypass AMSI and unhook ntdll to evade detection (‘An AMSI bypass’; ‘ntdll unhooking’).
• [T1056 ] Input Capture – The RAT collected camera, microphone, and system audio, indicating broad user-data capture (‘capture the endpoint’s camera input, the microphone and system audio’).
• [T1018 ] Remote System Discovery – The RAT enumerated host, network, and software details to profile the environment (‘Installed antivirus’; ‘open ports’; ‘installed software’).
• [T1071.004 ] Application Layer Protocol: DNS – The RAT used DNS-over-HTTPS via major resolvers to locate its Gate/C2 (‘uses DNS-over-HTTPS through Cloudflare, Google, and Quad9 servers’).
• [T1106 ] Native API – The chain relied on Windows-native functionality such as [scriptblock]::Create, msiexec, rundll32, and registry/task APIs (‘runs the rebuilt code with [scriptblock]::Create’; ‘through rundll32 or regsvr32’).
• [T1202 ] Indirect Command Execution – The attack used browser prompts and copy-paste instructions to trick victims into executing commands (‘telling users to copy-and-paste a command into their Terminal’).
• [T1129 ] Shared Modules – The malicious DLLs were loaded as modules by signed applications to execute code (‘the moment the Canon app loads its logger, rdCore.dll comes along for the ride’).