Loading story…
Attackers abused ChatGPT Custom GPT pages branded as “Plus 5.6” and promoted them through sponsored Google Search results to impersonate a legitimate ChatGPT model. Victims were redirected to a fake backup domain hosting a Google Sites page styled as ChatGPT and Cloudflare verification prompts; the ClickFix lure instructed them to run PowerShell, silently installing a malicious MSI and a sophisticated remote-access trojan (RAT). Huntress handled at least 40 incidents tied to the Google Sites domain, including two confirmed infections originating from Custom GPT lures, and observed replacement lures after the original was removed.
The campaign used signed third-party software for DLL sideloading and layered persistence. An initial variant abused Canon-signed CaptureOnTouch components, concealed its loader in a WAV file, and created Run-key and scheduled-task persistence labeled “Canon Configuration Reader.” A second variant preserved the RAT framework but used Stardock-signed DeElevate64.exe, a modified DeElevator64.dll, and a NuGet package carrier, establishing persistence as “Stardock DeElevation Tool.” Organizations should treat sponsored AI-tool search results and browser verification prompts that require shell commands as high-risk social-engineering activity.
Get the infrastructure and lures behind it.
4 events from the most recent confirmed update back to the earliest known activity.
Huntress identified a replacement malicious Custom GPT connected to the same RAT-delivery campaign after the initial lure was removed.
Huntress notified OpenAI about the first observed malicious “Plus 5.6” Custom GPT, after which that Custom GPT was taken down.
The delivery server hosted UltraFreeISOCreateWizardSolution.msi, indicating that the operators may have rotated signed application components and installer disguises used in the campaign.
Threat actors used sponsored Google Search results to direct victims to ChatGPT Custom GPTs impersonating legitimate models, which redirected to a Google Sites ClickFix page. The lure executed a PowerShell stager that installed MSI payloads and deployed a RAT using Canon- or Stardock-signed binaries for DLL sideloading and redundant Run-key and scheduled-task persistence.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
1 reference tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Threat actors are using legitimate ChatGPT shared-conversation URLs in a ClickFix campaign that presents Windows users with a fake availability warning and directs them to a fraudulent backup site. Neither ChatGPT nor OpenAI infrastructure was compromised. The lure persuades victims to open the Windows Run dialog and execute a clipboard-copied PowerShell command, which downloads and runs remote content associated with `brmconfig.com`; `openai-backup.one` and a masqueraded `video.mp4` resource are also linked to the delivery chain. The multi-stage loader profiles the host and sends device, public-IP, network, and geolocation data to attacker-controlled Telegram infrastructure before retrieving a legitimate MP4 file containing an encrypted PowerShell bundle. The bundle reportedly embeds 20 files, including a signed NetSupport remote-control client that can provide unauthorized remote access and monitoring. The malware hides consoles, checks for analysis-related hostnames, bypasses PowerShell execution policy, clears the Windows RunMRU history, and may leave artifacts under `ProgramData`, complicating detection and forensic review.
Sep 1, 2026
Multiple active malware campaigns are abusing *trusted distribution channels*—including Chrome/Edge extensions, Visual Studio Code extensions, and Google Ads/redirection infrastructure—to trick users into executing payloads that deliver **remote access trojans (RATs)** or **information stealers**. Huntress reported a malvertising-driven fake ad blocker extension, **NexShield**, that intentionally forces Chrome/Edge into a crash/DoS state by looping `chrome.runtime` port connections; on restart it displays a fake “security warning” and uses a **ClickFix-style** social engineering flow (“CrashFix”) to push users to paste and run clipboard-copied commands that trigger an obfuscated PowerShell download-and-execute chain, ultimately deploying the Python-based **ModeloRAT** in corporate environments. Separately, Trend Micro described **Evelyn Stealer** delivered via a trojanized **Visual Studio Code extension** that drops a malicious `Lightshot.dll` side-loaded by legitimate *Lightshot* (`Lightshot.exe`), then runs staged PowerShell and payload retrieval to steal browser credentials, cookies, crypto wallets, VPN/Wi‑Fi data, files, and screenshots before exfiltrating to an attacker-controlled FTP server—posing elevated risk when developer workstations are compromised. South Korea-focused activity also features prominently across several reports, with multiple delivery vectors leading to RAT deployment. ASEC documented **Remcos RAT** distributed via fake installers masquerading as *VeraCrypt* and via gambling-related “lookup” tools, using multi-stage obfuscated **VBS/PowerShell** chains and enabling credential theft, keylogging, and device surveillance (webcam/mic). Genians attributed “**Operation Poseidon**” to the **Konni APT**, describing spear-phishing that abuses Google’s advertising/tracking redirection (e.g., `ad.doubleclick.net` parameters) to make malicious links appear legitimate, redirecting victims to compromised WordPress infrastructure hosting ZIPs with LNK files that launch AutoIt-based loaders to run an **EndRAT** variant in memory. Nextron Systems reported widespread trojanized “free converter” apps promoted via malicious Google ads and lookalike converter sites (e.g., `ez2convertapp[.]com`, `convertyfileapp[.]com`), with some payloads signed using abused/rotating code-signing certificates (e.g., BLUE TAKIN LTD, TAU CENTAURI LTD, SPARROW TIDE LTD) to evade trust checks while installing persistent backdoors.
Jun 29, 2026
An active malware campaign is using **ClickFix** fake CAPTCHA pages to trick users into pasting and running malicious PowerShell commands. The infection chain deploys GHOSTPULSE—also known as **HijackLoader** or IDATLOADER—using DLL sideloading, followed by a .NET intermediary that decrypts and reflectively loads the ARECHCLIENT2/SectopRAT remote-access trojan directly into memory. The deceptive CAPTCHA pages were hosted on client subdomains of `dealeronlinemarketing.com` and `contology.com`, which researchers assess were likely enabled by the compromise of server `50.57.243[.]90`. ARECHCLIENT2 bypasses AMSI, profiles infected systems, steals credentials, browser data, and cryptocurrency-wallet information, and receives commands from rotating command-and-control infrastructure. SectopRAT is a .NET-based RAT with a history of anti-analysis protections, including ConfuserEx control-flow obfuscation and anti-tamper measures; its deployment through reflective loading further reduces disk-based detection opportunities. Organizations should prioritize user awareness of fake CAPTCHA copy-and-paste prompts and detect anomalous PowerShell execution, DLL sideloading, and in-memory .NET loading behavior.
Sep 9, 2026