Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, threat actors exploited ChatGPT Custom GPTs to create fake AI services that directed users to malicious Google Sites hosting ClickFix attacks. The campaign began with sponsored Google search results for "ChatGPT" leading to attacker-controlled Custom GPTs named "Plus 5.6." Victims were presented with fake service notices redirecting them to backup domains where fraudulent Cloudflare CAPTCHA checks prompted execution of malicious PowerShell commands. The attack deployed sophisticated RAT malware through DLL sideloading, encrypted payloads hidden in WAV files, and DNS-over-HTTPS C2 communication, infecting at least 40 users with comprehensive surveillance capabilities including screen capture, camera access, and file system exploration.

This incident represents the latest evolution in AI platform abuse, following previous campaigns weaponizing shared AI conversations and Claude Artifacts. The attack demonstrates how legitimate AI services are increasingly exploited as trusted entry points for social engineering, highlighting the urgent need for enhanced security controls around AI platform features and user-generated content validation.

Why This Matters Now

AI platforms are rapidly becoming weaponized attack vectors as threat actors exploit user trust in legitimate services like ChatGPT. With enterprise AI adoption accelerating and ClickFix campaigns proliferating across multiple platforms, organizations face immediate risks from employees unknowingly interacting with malicious AI-powered social engineering attacks.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers created malicious Custom GPTs named 'Plus 5.6' that appeared in sponsored Google search results, then programmed them to respond with fake service notices containing Google Sites links leading to ClickFix attacks.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would have constrained this ChatGPT Custom GPT attack by limiting lateral movement and reducing blast radius through segmentation and controlled egress enforcement.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Initial compromise may still occur through social engineering, but subsequent payload communications and network access would likely be constrained by fabric-wide visibility and policy enforcement

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Privilege escalation activities would likely be contained within segmented workload boundaries, limiting the scope of elevated access and reducing potential for system-wide compromise

Lateral Movement

Control: East-West Traffic Security

Mitigation: Lateral movement attempts would likely be blocked or significantly constrained by microsegmentation policies that restrict inter-workload communications and limit unauthorized east-west traffic flows

Command & Control

Control: Multicloud Visibility & Control

Mitigation: C2 communications would likely be detected and potentially disrupted through comprehensive traffic analysis and behavioral monitoring across cloud environments, limiting command execution capabilities

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Data exfiltration attempts would likely be constrained by controlled egress policies that limit outbound data flows and block unauthorized transmission of sensitive information to external destinations

Impact (Mitigations)

Residual impact would likely be limited to initially compromised workloads, with constrained persistence mechanisms and reduced capability for deploying additional malware across segmented network boundaries

Impact at a Glance

Affected Business Functions

  • Information Security Operations
  • Employee Productivity
  • Remote Access Systems
  • Data Protection
Operational Disruption

Estimated downtime: 2 days

Financial Impact

Estimated loss: $50,000

Data Exposure

Potential compromise of 40+ endpoints with RAT capabilities including screen capture, microphone and camera access, file system searches, credential theft from 17 web browsers, and system profiling data. Banking trojan capabilities for intercepting login credentials and two-factor authentication codes.

Recommended Actions

  • • Implement egress security and policy enforcement to block unauthorized DNS-over-HTTPS C2 communications and prevent data exfiltration to external domains
  • • Deploy cloud native security fabric with real-time inspection to detect and block ClickFix social engineering attacks and malicious PowerShell execution
  • • Enable multicloud visibility and control to identify anomalous interactions with AI platforms and suspicious automation patterns
  • • Establish zero trust segmentation with least privilege access to limit RAT lateral movement and secondary payload deployment
  • • Implement threat detection and anomaly response capabilities to identify covert tools like remote access trojans and baseline normal AI platform usage

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image