Attackers Abuse ChatGPT Custom GPTs to Deliver RAT

Threat actors are abusing ChatGPT Custom GPTs to pose as legitimate products and redirect victims to malicious sites using ClickFix lures. Huntress observed the campaign in late September 2026, with at least 40 users infected by a remote access trojan. The attack chain uses a fake Cloudflare CAPTCHA to trick users into running PowerShell commands that deploy an MSI installer and sideload a rogue DLL.