Malicious Custom GPTs Turn ChatGPT Into RAT Delivery Lure

Huntress reported a campaign that leverages malicious Custom GPTs hosted via the ChatGPT domain to funnel victims to a Google Sites landing page that uses ClickFix social engineering; victims are tricked into running a PowerShell command which downloads an MSI that sideloads malicious DLLs, extracts and decrypts an in‑memory loader from a WAV file, and deploys a RAT used to steal data, monitor users, and persist in the network. The firm observed at least 40 incidents and published technical indicators and detections to help defenders identify and contain infections.