<![CDATA[Custom ChatGPTs push ClickFix attacks to deploy RAT malware]]>Custom versions of ChatGPT are being advertised through sponsored Google search results and are redirecting users to malicious sites. These fake assistants use ClickFix attacks, a social engineering technique that tricks visitors into pasting and running malicious commands on their own machines, ultimately delivering remote access trojan (RAT) malware.

The campaign abuses trust in the ChatGPT brand by promoting lookalike custom GPT variants at the top of search results. Users who click through land on pages that instruct them to perform a fake verification or fix step, which is where the ClickFix payload is delivered. Because the commands are executed by the victim, the attack can bypass some traditional security controls.

Key points:

  • Malicious custom ChatGPT variants appear in sponsored Google results
  • Traffic is funneled to sites hosting ClickFix lures
  • The end goal is deployment of RAT malware
  • The attack relies on victims running commands themselves

If you or your users search for AI tools through ad-supported search results, treat sponsored links with caution and verify the destination before interacting with any prompt or "fix" instructions.

Source: BleepingComputer

Has anyone in the community seen ClickFix lures disguised as AI assistant tools in the wild, and how is your organization blocking them?

]]>https://xploitlk.com/topic/510/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malwareRSS for NodeTue, 27 Oct 2026 08:16:24 GMTTue, 29 Sep 2026 22:30:24 GMT60