Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix

This Huntress report analyzes an active, multi-stage malware campaign (dozens of confirmed incidents) that abused ChatGPT Custom GPT pages and Google Sites ClickFix lures to deliver MSI installers which sideloaded legitimate signed binaries (Canon, Stardock) to load malicious DLLs, in-memory loaders and a full-featured RAT; the writeup includes a complete technical decomposition of each stage, IOCs (URLs, IPs, filenames, SHA256s), and mitigation/detection guidance.