Custom ChatGPTs push ClickFix attacks to deploy RAT malware
-
Custom versions of ChatGPT are being advertised through sponsored Google search results and are redirecting users to malicious sites. These fake assistants use ClickFix attacks, a social engineering technique that tricks visitors into pasting and running malicious commands on their own machines, ultimately delivering remote access trojan (RAT) malware.
The campaign abuses trust in the ChatGPT brand by promoting lookalike custom GPT variants at the top of search results. Users who click through land on pages that instruct them to perform a fake verification or fix step, which is where the ClickFix payload is delivered. Because the commands are executed by the victim, the attack can bypass some traditional security controls.
Key points:
- Malicious custom ChatGPT variants appear in sponsored Google results
- Traffic is funneled to sites hosting ClickFix lures
- The end goal is deployment of RAT malware
- The attack relies on victims running commands themselves
If you or your users search for AI tools through ad-supported search results, treat sponsored links with caution and verify the destination before interacting with any prompt or "fix" instructions.
Source: BleepingComputer
Has anyone in the community seen ClickFix lures disguised as AI assistant tools in the wild, and how is your organization blocking them?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login