Attackers Combine ChatGPT Feature Abuse With ClickFix to Deliver Trojan Malware

Huntress found an active campaign leveraging malicious ChatGPT CustomGPTs (e.g., “Plus 5.6”) and sponsored search results to lure users to a faux Cloudflare CAPTCHA (a ClickFix attack) that instructs victims to paste and run commands; this installs a malicious MSI that sideloads a Canon-signed app and deploys a remote access trojan capable of audio/video capture, data exfiltration, and further payload delivery. At least 40 infections were observed; the CustomGPT was reported and removed, but researchers have already identified new related CustomGPTs.