ClickFix Campaign Abuses ChatGPT Links to Deploy NetSupport Remote-Access Malware
Malware Intelligence · 4 sources · Updated 2mo ago · First seen Sep 1, 2026
Threat actors are using legitimate ChatGPT shared-conversation URLs in a ClickFix campaign that presents Windows users with a fake availability warning and directs them to a fraudulent backup site. Neither ChatGPT nor OpenAI infrastructure was compromised. The lure persuades victims to open the Windows Run dialog and execute a clipboard-copied PowerShell command, which downloads and runs remote content associated with brmconfig.com; openai-backup.one and a masqueraded video.mp4 resource are also linked to the delivery chain.
The multi-stage loader profiles the host and sends device, public-IP, network, and geolocation data to attacker-controlled Telegram infrastructure before retrieving a legitimate MP4 file containing an encrypted PowerShell bundle. The bundle reportedly embeds 20 files, including a signed NetSupport remote-control client that can provide unauthorized remote access and monitoring. The malware hides consoles, checks for analysis-related hostnames, bypasses PowerShell execution policy, clears the Windows RunMRU history, and may leave artifacts under ProgramData, complicating detection and forensic review.
