Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures
-
Threat actors are abusing ChatGPT Custom GPTs to pose as legitimate product offerings and redirect victims to malicious sites that use ClickFix lures to deliver malware.
According to Huntress, which observed the activity in late September 2026, this is the latest example of attackers weaponizing features within trusted artificial intelligence platforms. Earlier campaigns similarly abused shared components of these platforms to lend credibility to their operations.
The abuse chain relies on the trusted ChatGPT brand to lower victim suspicion before pushing them toward fake sites. Once there, ClickFix lures trick users into executing malicious commands, ultimately leading to a RAT payload. Huntress noted that prior campaigns have weaponized shared features in AI platforms, indicating a continuing trend rather than an isolated incident.
- Attackers disguise Custom GPTs as legitimate product offerings
- Victims are directed to malicious sites that host ClickFix lures
- ClickFix prompts lead to malware delivery, including a RAT
- Observed activity dates to late September 2026
Source: The Hacker News
Has your organization seen any suspicious Custom GPT links shared internally, and what controls do you have in place to block ClickFix-style lures?
Hello! It looks like you're interested in this conversation, but you don't have an account yet.
Getting fed up of having to scroll through the same posts each visit? When you register for an account, you'll always come back to exactly where you were before, and choose to be notified of new replies (either via email, or push notification). You'll also be able to save bookmarks and upvote posts to show your appreciation to other community members.
With your input, this post could be even better 💗
Register Login