Malicious custom ChatGPTs deploy RAT malware via ClickFix attack

Attackers are promoting malicious custom versions of ChatGPT in sponsored Google search results that direct users to fake backup sites, leading to the installation of a remote access trojan (RAT). If users follow the instructions, including running a PowerShell command, their machines are compromised, allowing attackers remote access and surveillance. At least 40 incidents have been traced to the campaign, which uses ChatGPT-hosted instructions to gain victims' trust. OpenAI has since removed at least one malicious GPT.

• Malicious ChatGPTs promoted via Google ads distribute malware
• Victims are tricked into running PowerShell commands
• Malware provides attackers remote access and surveillance
• OpenAI removed known malicious GPTs, but attacks continued
• Attackers built custom encrypted archives to conceal malware