This weekly bulletin highlights multiple real-world incidents, including phishing and impersonation campaigns. Notably, researchers found attackers using malicious “Custom GPTs” on ChatGPT to redirect victims to a Google Sites page and trick them into running commands that install remote-access malware. The bulletin also describes an espionage campaign that builds trust via benign emails before sending victims to credential-stealing Microsoft 365 phishing pages.
Researchers found that malicious Custom GPTs hosted on ChatGPT were used in a ClickFix style campaign to deliver remote access malware. A victim interacting with a seemingly helpful Custom GPT would be directed to follow troubleshooting steps on a linked page to resolve an issue. That link led to a Google Sites page where victims were tricked into running commands on their own computers. Huntress investigated at least 40 related incidents tied to this activity, including two confirmed infections that began through Custom GPTs.
A separate scenario in the same bulletin describes TA419, an espionage actor that targets US AI policy experts at think tanks, universities, and law firms. This group impersonates prominent economists and AI policymakers, builds rapport through benign emails, then redirects targets to phishing pages designed to steal Microsoft 365 credentials and session cookies. Both cases show how attackers use trusted-seeming interfaces, whether an AI chat assistant or a familiar-sounding sender, to move a target toward an action that compromises their device or account.
The ClickFix style lure works because people are conditioned to trust guidance that appears inside a tool they already use for help, such as a chat assistant. Framing the malicious steps as a routine fix lowers suspicion and encourages victims to run commands without checking with IT support first. Hosting the final instructions on Google Sites, a legitimate and widely used platform, added a layer of apparent legitimacy that may have reduced scrutiny.
In the TA419 scenario, success relied on a slower build-up. Benign emails established rapport before any request was made, so by the time a Microsoft 365 login link appeared, the target had already built some trust with the sender.
Treat instructions from AI assistants and chat tools the same way you would treat an unsolicited email: verify before acting. Do not run commands or install software based solely on guidance from a Custom GPT or similar tool without checking with IT or security staff. For email-based requests, especially ones that build familiarity over time before asking for a login, confirm the sender's identity through an independent channel before entering credentials anywhere, including Microsoft 365 pages reached via a link.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
It is a campaign where malicious Custom GPTs hosted on ChatGPT redirected victims to a Google Sites page and convinced them to run commands that installed remote-access malware.
Huntress investigated at least 40 related incidents, including two confirmed infections that began through Custom GPTs.
No, TA419 is a separate espionage campaign described in the same bulletin that impersonates economists and policymakers to steal Microsoft 365 credentials and session cookies.
Be wary of any instructions, including from AI assistants, that push you to run commands or scripts, especially when the content is hosted on an unusual site like Google Sites instead of an official vendor domain.
Imagine a Custom GPT called “ClickFix” tells you: “Click here and run these commands to fix your issue.” Looks legit, right? Researchers found malicious Custom GPTs doing exactly this, redirecting people to a Google Sites page and tricking them into running commands that installed remote‑access malware. Huntress saw at least 40 of these ClickFix cases. Here’s the trap: the GPT feels like a trusted helper, but the “fix” lives on an odd site like Google Sites and pushes you to copy commands into your machine, outside any normal IT process. If any AI tool tells you to run commands or install something from a link, stop and send a screenshot to IT or Security before you do anything.
This weekly recap highlights multiple real-world campaigns where attackers trick users into taking actions that grant access, without needing to steal passwords directly. Notable examples include “device code” phishing (victims are instructed to enter a short code to approve an attacker session)…
This news roundup describes real social-engineering operations where attackers impersonate trusted support teams to trick people into giving up secrets. One campaign uses email/SMS/WhatsApp plus AI voice calls pretending to be Apple Support to steal iPhone passcodes, while another uses phishing…
Researchers say the Iran-linked group Nimbus Manticore posed as recruiters on LinkedIn and job platforms to send developers “technical challenge” ZIP files that secretly installed cross-platform remote access trojans. The lures used urgency (short test windows) and realistic developer workflows…
A real phishing campaign targeted Call of Duty Mobile players by promising free in-game currency. Victims were tricked into entering their email and password, then providing a 2FA code on a follow-up page, enabling attackers to take over accounts.
This roundup describes real-world social engineering, including phishing emails that impersonate ChatGPT billing to steal payment card data and a convicted attacker who posed as Snapchat support to trick people into handing over login codes. The common theme is impersonation of trusted brands to…
A China-aligned group (TA419) impersonated well-known U.S. figures to lure AI policy experts into a fake OneDrive/Microsoft 365 login that could steal session cookies even when MFA is enabled. Separately, two U.S. airmen were sentenced for a multi-year business email compromise scheme where they…
