Attackers weaponise ChatGPT Custom GPTs to deliver RAT via eight-stage ClickFix chain

Threat actors are abusing ChatGPT's Custom GPT feature to deliver a remote access trojan (RAT) through an eight-stage ClickFix chain, according to new research from Huntress. The attackers created a Custom GPT titled "Plus 5.6" that impersonates a genuine ChatGPT model, and because Custom GPTs are hosted on chatgpt.com, the malicious page inherits the platform's trusted domain. The campaign funnels victims from the trusted ChatGPT domain into the multi-stage ClickFix infection that ends with a full-featured RAT.

Threat actors are abusing ChatGPT’s Custom GPT feature to funnel victims into a ClickFix attack that ends with a full-featured remote access trojan RAT , according to new research from Huntress. The attackers created a Custom GPT titled “Plus 5.6”, designed to pass as a genuine ChatGPT model. Because Custom GPTs are hosted on chatgpt.com, the … The post Attackers weaponise ChatGPT Custom GPTs to deliver RAT via eight-stage ClickFix chain https://www.itsecurityguru.org/2026/09/29/attackers-weaponise-chatgpt-custom-gpts-to-deliver-rat-via-eight-stage-clickfix-chain/ appeared first on IT Security Guru https://www.itsecurityguru.org .