Loading story…
Threat actors are using legitimate ChatGPT shared-conversation URLs in a ClickFix campaign that presents Windows users with a fake availability warning and directs them to a fraudulent backup site. Neither ChatGPT nor OpenAI infrastructure was compromised. The lure persuades victims to open the Windows Run dialog and execute a clipboard-copied PowerShell command, which downloads and runs remote content associated with brmconfig.com; openai-backup.one and a masqueraded video.mp4 resource are also linked to the delivery chain.
The multi-stage loader profiles the host and sends device, public-IP, network, and geolocation data to attacker-controlled Telegram infrastructure before retrieving a legitimate MP4 file containing an encrypted PowerShell bundle. The bundle reportedly embeds 20 files, including a signed NetSupport remote-control client that can provide unauthorized remote access and monitoring. The malware hides consoles, checks for analysis-related hostnames, bypasses PowerShell execution policy, clears the Windows RunMRU history, and may leave artifacts under ProgramData, complicating detection and forensic review.
Pull IOCs and campaign context straight into your stack.
1 event from the most recent confirmed update back to the earliest known activity.
A malicious ClickFix campaign used a legitimate ChatGPT shared-conversation URL to direct Windows users to an OpenAI-themed fake backup site, where a clipboard-copied PowerShell command fetched a multi-stage loader from brmconfig.com. The loader profiled victims, sent telemetry to a Telegram chat, retrieved an MP4 concealing an encrypted PowerShell bundle, and deployed a signed NetSupport remote-control client; ChatGPT and OpenAI infrastructure were not compromised.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. View all 14 in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Pull the IOCs, campaigns, and victimology behind this family, ready to push into your SIEM and EDR.
4 references tracked. Mallory keeps watching after this page renders.
cybersecuritynews.com
Open sourcecryptika.com
Open sourcecyberveille.ch
Open sourcecyberveille.ch
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
An active malware campaign is using **ClickFix** fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as **HijackLoader** or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of `dealeronlinemarketing.com` and `contology.com`, which researchers assess were likely enabled by the compromise of server `50.57.243[.]90`. ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
Sep 9, 2026
Security researchers reported multiple active campaigns using **ClickFix** social engineering—fake error dialogs or verification prompts that trick users into manually running attacker-supplied commands—to bypass browser and download protections and establish an initial foothold. In one enterprise case investigated by **CERT Polska (cert.pl)**, victims were lured via compromised websites showing a fake CAPTCHA/“fix” prompt that instructed them to paste and run a **PowerShell** command via `Win+R`; the script then downloaded a dropper and enabled rapid follow-on activity that can scale to **enterprise-wide compromise**, including deployment of secondary malware such as **Latrodectus** and **Supper** for data theft, lateral movement, and potential ransomware staging. A separate ClickFix operation targeted **macOS developers** by cloning the *Homebrew* site on typosquatted infrastructure; the “install” command was subtly altered to fetch content from `raw.homabrews.org` instead of `raw.githubusercontent.com`, leading to **Cuckoo Stealer** deployment and credential harvesting via repeated password prompts using macOS Directory Services, with related domains tied to shared hosting at **`5.255.123.244`**. ClickFix was also observed as the initial execution mechanism for the resurfaced **Matanbuchus 3.0** MaaS loader, which uses deceptive copy/paste prompts and **silent MSI** execution (via `msiexec`) to deliver a new payload, **AstarionRAT**, enabling capabilities including credential theft and **SOCKS5** proxying; operators were reported to move laterally quickly (including toward domain controllers), consistent with ransomware or data-exfiltration objectives.
Jul 2, 2026
Attackers abused ChatGPT Custom GPT pages branded as **“Plus 5.6”** and promoted them through sponsored Google Search results to impersonate a legitimate ChatGPT model. Victims were redirected to a fake backup domain hosting a Google Sites page styled as ChatGPT and Cloudflare verification prompts; the ClickFix lure instructed them to run PowerShell, silently installing a malicious MSI and a sophisticated remote-access trojan (RAT). Huntress handled at least 40 incidents tied to the Google Sites domain, including two confirmed infections originating from Custom GPT lures, and observed replacement lures after the original was removed. The campaign used signed third-party software for DLL sideloading and layered persistence. An initial variant abused Canon-signed CaptureOnTouch components, concealed its loader in a WAV file, and created Run-key and scheduled-task persistence labeled **“Canon Configuration Reader.”** A second variant preserved the RAT framework but used Stardock-signed `DeElevate64.exe`, a modified `DeElevator64.dll`, and a NuGet package carrier, establishing persistence as **“Stardock DeElevation Tool.”** Organizations should treat sponsored AI-tool search results and browser verification prompts that require shell commands as high-risk social-engineering activity.
Sep 28, 2026