Custom GPTs, a tailored version of ChatGPT built for specific purposes designed to make ChatGPT easier, is now being used by cybercriminals to distribute malware on Windows.

Cybersecurity platform, Huntress, has discovered a campaign in which criminals use Custom GPTs, made publicly available for use, to spread malware.

The malware is not distributed directly through ChatGPT, rather the manipulated GPT redirects users to a supposed backup website. However, this is fraudulent and a fake "security check" appears, prompting them to execute a PowerShell command on Windows.

The command downloads a malicious installation package and begins a multi-stage infection chain.

The malware is a Remote Access Trojan (RAT) which allows extensive control in systems that can search files, collect information, access audio and cameras, and access desktop functions.

This method is known as ClickFix. It relies on social engineering to trick users into executing the malware themselves rather than exploiting technical vulnerabilities.

The manipulated GPTs are being sponsored via search results on Google by the criminals.

Source: https://uk.news.yahoo.com/chatgpt-becomes-malware-trap-114100556.html

Commentary

In reported attacks involving malicious custom GPTs, attackers used content hosted on a legitimate platform to direct users to external websites where deceptive instructions persuaded them to run commands that downloaded and installed malware. The trusted platform served as the entry point - not as an assurance that the content or linked destination was safe.

These attacks demonstrate that social engineering extends beyond email. A familiar interface or recognizable domain can make a fraudulent request appear credible. In this campaign, attackers used supposed service interruptions and fake verification prompts to encourage users to follow malicious instructions.

Organizations should incorporate these risks into their AI governance and security awareness programs. Reviews should consider not only the platform itself, but also the specific tool, its intended business purpose, its external links, and any instructions it gives users.

To help reduce these risks, organizations should use the following prevention checklist:

• Establish an approval process. Require designated security and business personnel to review AI services, including Custom GPTs, before employees use them for organizational work.
• Confirm the business purpose. Document why the tool is needed, who may use it, and what activities are permitted.
• Review external destinations. Examine links, redirects, and connected services. Do not assume that an external website is trustworthy simply because the link appears within a legitimate AI platform. Malicious custom GPTs have used this approach to move users into malware-delivery workflows.
• Scrutinize installation and execution requests. Require IT or security approval before users install additional software, execute scripts, or paste commands into PowerShell, Terminal, or the Windows Run dialog. Unexpected requests to run code or change security settings should be treated as highly suspicious.
• Train employees to recognize deceptive prompts. Include examples involving fake verification checks, supposed service outages, and "backup" websites. Instruct employees to stop and seek assistance rather than follow unexpected technical instructions.
• Reassess approved tools. Establish periodic reviews and reassess tools when their functionality, external connections, or requested permissions change.
• Provide a clear reporting process. Explain how employees should report suspicious AI interactions and promptly disclose whether they clicked a link, downloaded a file, or executed a command.

The final takeaway is that a trusted AI platform does not make every tool, link, or instruction within it trustworthy. Organizations should strengthen AI-tool reviews, reinforce employee awareness, and require independent verification of unexpected requests to install software or execute commands.

Additional Sources: https://www.huntress.com/blog/chatgpt-custom-gpts-clickfix-rat; https://www.ibm.com/think/news/custom-gpt-clickfix-attacks; https://www.cyber.gov.au/guidance/learn-about-social-engineering