Malicious custom ChatGPT variants promoted in sponsored Google results are luring users to fake backup sites that trigger ClickFix attacks and install malware through PowerShell commands. Huntress says the campaign used OpenAI-hosted GPTs like “Plus 5.6” and delivered a RAT with persistence via Windows Run keys and scheduled tasks. #OpenAI #ChatGPT #Plus5.6 #Huntress
Keypoints
- Sponsored Google results promoted malicious custom ChatGPT variants.
- The GPTs redirected users to a fake backup site on Google Sites.
- Victims were tricked into running a PowerShell command in a ClickFix attack.
- The payload installed a RAT with desktop, camera, audio, and file access.
- Persistence was maintained through Windows Registry Run keys and scheduled tasks.