Story perspectives

Custom GPT Used to Deliver ClickFix Malware, Huntress Reports

By Drooid · Oct 1, 2026, 6:18 PM UTC · How we work

Summary

Story summary

Threat actors abused ChatGPT Custom GPTs to deliver ClickFix malware.
The Custom GPT “Plus 5.6” linked to a Google Sites page with a Cloudflare CAPTCHA instructing PowerShell command.
The command installed an MSI that sideloaded a rogue DLL loading shellcode and an Access Trojan.
Huntress reported 40 infections and identified the RAT payload “@input,” which gives full control.
Researchers said the campaign reappeared within days after the Custom GPT was removed.

1 of 1

Story summary

Threat actors abused ChatGPT Custom GPTs to deliver ClickFix malware.
The Custom GPT “Plus 5.6” linked to a Google Sites page with a Cloudflare CAPTCHA instructing PowerShell command.
The command installed an MSI that sideloaded a rogue DLL loading shellcode and an Access Trojan.
Huntress reported 40 infections and identified the RAT payload “@input,” which gives full control.
Researchers said the campaign reappeared within days after the Custom GPT was removed.