Clearance Incident Response. Free through May 1, so you have time to patch.Measure in 5 min. Free AssessmentFree Assessment

aviatrix logoAviatrix
Under Active Attack

Executive Summary

In September 2026, threat actors launched a sophisticated ClickFix campaign exploiting OpenAI's Custom GPT feature to deliver remote access Trojans (RATs). Attackers created malicious Custom GPTs mimicking legitimate ChatGPT releases, leveraging trusted domains from OpenAI and Google to deceive victims. The attack chain began when users interacted with fake Custom GPTs named "Plus 5.6" through the official ChatGPT domain, then redirected to a Google Sites page with fake CAPTCHA prompts. Victims were tricked into executing PowerShell commands that downloaded MSI files, which used legitimate Canon-signed applications to sideload malicious DLLs and deploy RATs capable of data theft, surveillance, and network infiltration. Huntress security researchers documented at least 40 confirmed incidents from this campaign. This attack represents an evolution in social engineering tactics, exploiting trust in AI platforms and legitimate cloud infrastructure to bypass traditional security awareness training focused on domain verification.

Why This Matters Now

This incident highlights the emerging threat of AI platform abuse as Custom GPTs and similar AI tools proliferate in enterprise environments. The exploitation of trusted AI domains undermines traditional security awareness training and demonstrates how attackers are adapting to leverage users' growing dependence on AI assistants.

Attack Path Analysis

MITRE ATT&CK® Techniques

Potential Compliance Exposure

Sector Implications

Sources

Frequently Asked Questions

Attackers created fake Custom GPTs that appeared legitimate on the official ChatGPT domain, then redirected users to malicious Google Sites pages with fake CAPTCHA prompts that executed PowerShell commands to download RATs.

Cloud Native Security Fabric Mitigations and ControlsCNSF

Based on the attack progression modeled above, these are the defensive controls that would constrain each stage.

Aviatrix Zero Trust CNSF would likely reduce the blast radius of this Custom GPT-initiated attack by constraining lateral movement between network segments and limiting the scope of RAT communications through segmented access controls.

Initial Compromise

Control: Cloud Native Security Fabric (CNSF)

Mitigation: Cloud-native visibility and policy enforcement would likely limit the initial foothold establishment by constraining which network resources the compromised endpoint could access immediately after PowerShell execution.

Privilege Escalation

Control: Zero Trust Segmentation

Mitigation: Zero Trust segmentation would likely constrain the privileged process's network reachability, limiting which systems and services the sideloaded DLL could communicate with despite achieving code execution on the compromised host.

Lateral Movement

Control: East-West Traffic Security

Mitigation: East-west traffic controls would likely limit the RAT's ability to discover and access adjacent systems, constraining network reconnaissance and reducing the attacker's capability to establish footholds on additional organizational endpoints.

Command & Control

Control: Multicloud Visibility & Control

Mitigation: Multicloud visibility controls would likely limit the RAT's command channel establishment by constraining which external destinations the compromised workload could reach for persistent communication and payload retrieval activities.

Exfiltration

Control: Egress Security & Policy Enforcement

Mitigation: Egress security policies would likely constrain the RAT's data transmission capabilities by limiting outbound network paths and restricting which external destinations could receive stolen file contents and captured surveillance data.

Impact (Mitigations)

The overall impact scope would likely be reduced to the initially compromised network segment, with constrained ability to affect critical business systems or establish widespread organizational presence for sustained espionage operations.

Impact at a Glance

Affected Business Functions

  • Information Technology Operations
  • Data Security and Privacy Controls
  • Employee Productivity Systems
  • Network Security Infrastructure
Operational Disruption

Estimated downtime: 3 days

Financial Impact

Estimated loss: $75,000

Data Exposure

Browser credentials, session tokens, endpoint configuration data, and potential network reconnaissance information. The RAT enables remote desktop access, camera and microphone surveillance, file system access, and creation of unauthorized user accounts for persistent access.

Recommended Actions

  • • Deploy Cloud Native Security Fabric (CNSF) with real-time inspection to detect and block malicious Custom GPT interactions and shadow AI usage through behavioral analysis and prompt injection detection
  • • Implement Egress Security & Policy Enforcement with FQDN filtering to prevent unauthorized outbound connections to malicious Google Sites domains and block PowerShell-initiated downloads of suspicious MSI files
  • • Enable Threat Detection & Anomaly Response capabilities to identify covert tools like remote access applications and detect baseline deviations from normal user behavior patterns during ClickFix exploitation attempts
  • • Configure Zero Trust Segmentation with identity-based policies and least privilege access to limit RAT lateral movement capabilities and prevent creation of unauthorized user accounts across network segments
  • • Establish Multicloud Visibility & Control with centralized policy enforcement to detect anomalous automation patterns, repeated malformed requests to legitimate domains, and suspicious cross-domain redirections from trusted infrastructure

Secure the Paths Between Cloud Workloads

A cloud-native security fabric that enforces Zero Trust across workload communication—reducing attack paths, compliance risk, and operational complexity.

Stop Advanced ThreatsFree Containment AssessmentUnder Active Attack?
Cta pattren Image