Scammers are now exploiting OpenAI’s custom GPTs to trick users into infecting their computers with dangerous Remote Access Trojan (RAT) malware through deceptive “ClickFix” tactics.

(“ClickFix” is basically the name cybersecurity researchers gave to this type of attack technique.)

Scam watch report*

Malicious actors are creating customized versions of ChatGPT such as one named “Plus 5.6”, and promoting them via sponsored Google search results.

When users interact with these custom AI assistants on the legitimate chatgpt.com domain, the chatbot directs them to external sites to run a fake system fix. In reality, following the instructions executes malicious scripts that grant attackers total remote control over the target’s system.

How the scam works

• The Bait: Users searching for enhanced or premium ChatGPT features click on sponsored Google ads that redirect them to custom-built ChatGPT models hosted directly on OpenAI’s official platform.
• The Deception: Because the prompt interaction happens on a trusted chatgpt.com URL, users drop their guard. The custom GPT claims there is an error or backup required and provides a link to a Google Sites landing page featuring a fake Cloudflare security check.
• The Trap: The site prompts the user to fix the issue using a “ClickFix” social engineering trick—asking them to copy and paste a PowerShell command into their terminal. Executing this command silently downloads and installs a Remote Access Trojan (RAT).
• The Impact: Once installed, the RAT allows hackers to control your desktop remotely, record audio and video from your camera and microphone, search files, and establish permanent access on your Windows machine (often masquerading under tasks named “Canon Configuration Reader”).

Red flags to watch for

• Requests to run command-line code: No legitimate web app or Cloudflare check will ever ask you to copy code into Windows PowerShell or Command Prompt to “verify” or “fix” a connection.
• Off-platform redirects: A custom GPT directing you outside of ChatGPT to perform a system or “backup” update on an external domain like Google Sites.
• Third-party software downloads: Prompts from an AI assistant telling you to download .msi or .exe installer files to continue using the service.

What to do if you suspect you’re affected

1. Disconnect from the network: If you ran a command supplied by a suspicious website, immediately disconnect your device from Wi-Fi or Ethernet to stop active remote access.
2. Inspect Scheduled Tasks & Registry Keys: Look for unauthorized persistence entries under %LOCALAPPDATA%\Programs\ or Scheduled Tasks named Canon Configuration Reader.
3. Run a full system scan: Use trusted antivirus or anti-malware software to detect and isolate memory-resident payloads or modified DLL files.

---

*(Complex digital scams can be confusing sometimes, so we break them down into plain, straightforward terms to help you understand better.)

Additional info:

The scam in simple terms

Imagine someone searching Google for “ChatGPT”.

1. The attacker buys a Google advertisement.
   The victim clicks what appears to be a legitimate result.
2. They are taken to a real ChatGPT.com page.
   This is the clever part. The attacker had created a malicious custom GPT called “Plus 5.6”. Because custom GPTs were hosted on ChatGPT’s legitimate domain, the victim sees chatgpt.com and is less suspicious.
3. The fake GPT tells the victim there is a backup website.
   It sends them to a Google Sites page.
4. The Google Sites page pretends to be a Cloudflare security check.
   It essentially says: “Your browser needs verification. Follow these instructions.”
5. This is the “ClickFix” part.
   The victim is told to copy and paste a command into Windows PowerShell.
6. The victim runs the command.
   That command downloads and installs malware.
7. The malware installs a RAT.
   RAT means Remote Access Trojan. Think of it as giving the attacker a remote-control tool inside your computer.

It’s similar to someone putting a fake notice inside a genuine bank branch. The building is real, but the notice isn’t.

A big shout out to bleepingcomputer.com