Attackers Abuse ChatGPT Custom GPTs to Deploy a Full-Featured RAT

**Executive summary:** Huntress researchers observed a multi-stage campaign abusing fake ChatGPT Custom GPT pages and a ClickFix social-engineering lure to deliver a resilient remote access trojan (RAT). The attack uses a PowerShell one-liner to download an obfuscated MSI, achieves persistence and DLL sideloading via legitimately signed Canon and later Stardock binaries, decodes loaders in memory (including from WAV/NuGet containers), and unpacks a custom encrypted filesystem holding the RAT; the malware supports remote desktop, camera/audio capture, browser data theft, DoH-based C2, and robust evasion techniques. Detection should focus on behavioral indicators (PowerShell->msiexec on GUID-named MSI in temp, signed binaries running from fake AppData folders, and persistent Run keys/scheduled tasks) rather than static names.