Executive Summary
In September 2026, threat actors exploited OpenAI's custom ChatGPT feature to distribute remote access trojan (RAT) malware through ClickFix attacks. The attackers created malicious custom GPT models promoted via sponsored Google search results, directing users to fake Cloudflare verification pages that instructed victims to execute PowerShell commands. These commands deployed a sophisticated multi-stage infection chain involving legitimate signed applications and modified DLLs to establish persistent RAT access with capabilities for remote desktop control, surveillance, and additional payload deployment. The campaign affected dozens of users and demonstrated a novel abuse of AI platforms for malware distribution.
This incident highlights the growing trend of threat actors weaponizing legitimate AI services and the increasing sophistication of social engineering attacks that leverage trusted platforms like ChatGPT and Google to bypass user skepticism and security controls.
Why This Matters Now
The weaponization of AI platforms for malware delivery represents a critical evolution in attack vectors, as organizations increasingly adopt AI tools without adequate security controls, creating new attack surfaces that traditional defenses may not address.
Attack Path Analysis
Attackers created malicious custom ChatGPT variants promoted through sponsored Google results to redirect users to fake Cloudflare verification pages. Users executed malicious PowerShell commands that installed MSI packages containing RAT malware with persistence mechanisms. The RAT established command and control capabilities for remote desktop access, surveillance, and additional payload deployment. The malware maintained persistence through registry keys and scheduled tasks while operating primarily in memory to evade detection.
Kill Chain Progression
This analysis maps confirmed threat intelligence to the full cloud kill chain to show where defensive gaps would emerge as an attack progresses.
Initial Compromise
Description
Custom ChatGPT variants named 'Plus 5.6' were created and promoted via sponsored Google results, directing users to malicious Google Sites pages displaying fake Cloudflare verification requiring PowerShell execution
MITRE ATT&CK® Techniques
Phishing: Spearphishing Link
Command and Scripting Interpreter: PowerShell
System Binary Proxy Execution: Msiexec
Boot or Logon Autostart Execution: Registry Run Keys / Startup Folder
Scheduled Task/Job: Scheduled Task
Create or Modify System Process: Windows Service
Screen Capture
Data from Local System
Potential Compliance Exposure
Mapping incident impact across multiple compliance frameworks.
PCI DSS 4.0 – Software Engineering Techniques
Control ID: 6.4.2
NYDFS 23 NYCRR 500 – Training and Monitoring
Control ID: 500.14
DORA – ICT Risk Management Framework
Control ID: Article 11
CISA Zero Trust Maturity Model 2.0 – Endpoint Security
Control ID: DE.AE-2
NIS2 Directive – Cybersecurity Risk Management Measures
Control ID: Article 21
ISO 27001:2022 – Web Filtering
Control ID: A.8.23
Sector Implications
Industry-specific impact of the vulnerabilities, including operational, regulatory, and cloud security risks.
Computer Software/Engineering
Custom ChatGPT exploitation targeting developers through ClickFix attacks deploying RATs poses significant risks to software development environments and code security.
Information Technology/IT
RAT malware deployment via malicious PowerShell commands threatens IT infrastructure with remote access capabilities, lateral movement, and persistent registry-based attacks.
Financial Services
Encrypted traffic vulnerabilities and egress security gaps expose financial institutions to data exfiltration through sophisticated RAT malware with reconnaissance capabilities.
Health Care / Life Sciences
HIPAA compliance violations likely through compromised east-west traffic security enabling lateral movement and unauthorized access to protected health information systems.
Sources
- Custom ChatGPTs push ClickFix attacks to deploy RAT malwarehttps://www.bleepingcomputer.com/news/security/custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware/Verified
- ChatGPT Custom GPTs + ClickFix = RAThttps://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-ratVerified
- Google Ads for shared ChatGPT, Grok guides push macOS infostealer malwarehttps://www.bleepingcomputer.com/news/security/google-ads-for-shared-chatgpt-grok-guides-push-macos-infostealer-malware/Verified
Frequently Asked Questions
Cloud Native Security Fabric Mitigations and ControlsCNSF
Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.
Aviatrix Zero Trust CNSF would have constrained this ChatGPT-themed RAT attack by limiting lateral movement opportunities and reducing command and control reach through segmented network access and controlled egress paths.
Control: Cloud Native Security Fabric (CNSF)
Mitigation: Cloud-native visibility and policy enforcement may have flagged suspicious PowerShell execution patterns and restricted access to untrusted external sites hosting malicious MSI packages
Control: Zero Trust Segmentation
Mitigation: Zero trust microsegmentation would likely have limited the scope of privilege escalation by restricting lateral access paths and isolating compromised workloads from critical infrastructure components
Control: East-West Traffic Security
Mitigation: East-west traffic inspection and segmentation would have significantly reduced potential lateral movement opportunities by blocking unauthorized inter-workload communication and restricting network traversal paths
Control: Multicloud Visibility & Control
Mitigation: Comprehensive multicloud visibility may have detected anomalous encrypted communication patterns and restricted the RAT's ability to maintain persistent command channels across cloud infrastructure boundaries
Control: Egress Security & Policy Enforcement
Mitigation: Egress security controls would likely have constrained data exfiltration capabilities by blocking unauthorized outbound connections and limiting the volume of data that could be transmitted to external C2 infrastructure
While persistence mechanisms may remain active on the compromised endpoint, the overall blast radius and operational impact would be significantly reduced through network segmentation and restricted access to critical assets
Impact at a Glance
Affected Business Functions
- Remote Work Operations
- Data Security
- IT Infrastructure
- User Productivity
Estimated downtime: 3 days
Estimated loss: N/A
Potential compromise of host systems with remote desktop access, audio and camera capture capabilities, file system access, and ability to run additional payloads affecting at least 40 investigated incidents
Recommended Actions
Key Takeaways & Next Steps
- • Implement Egress Security & Policy Enforcement to block unauthorized PowerShell connections to external malicious sites and prevent RAT C2 communications
- • Deploy Inline IPS (Suricata) with signature-based detection to identify and block known malicious PowerShell payloads and MSI installation patterns
- • Enable Cloud Firewall (ACF) with URL filtering to prevent access to malicious Google Sites pages and suspicious domain redirects
- • Establish Multicloud Visibility & Control to monitor anomalous PowerShell execution patterns and suspicious scheduled task creation
- • Activate Threat Detection & Anomaly Response capabilities to baseline normal user behavior and alert on remote access tool installations and persistence mechanisms
