Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA, where they’re tricked into copy/pasting commands (ClickFix) that lead to malware installation and a remote access trojan (RAT).
This campaign began with a fake CustomGPT named Plus 5.6, built to look like the real ChatGPT. Victims searching for 'chatgpt' on Google were directed to it through sponsored search results, which gave the fake tool an air of legitimacy before a user ever clicked. Once on the site, the CustomGPT displayed a 'Service Availability Notice' claiming limited availability on the 'primary domain' and pushing users toward a 'backup domain' instead.
That backup domain was designed to look like a Cloudflare CAPTCHA check. Instead of a simple checkbox, it asked users to copy and paste a command to 'verify' themselves, a technique known as ClickFix. Following the instructions led to a malicious MSI installer that deployed a Canon-signed application used for sideloading and persistence, ultimately delivering a remote access trojan (RAT) capable of monitoring activity, capturing audio and video, and exfiltrating data to attacker-controlled infrastructure.
The flow leaned heavily on brand trust. Every step borrowed a name people already recognize, from ChatGPT and Google to Cloudflare and Canon. Each brand on its own looked routine, and stacking them together made the overall chain feel more credible than any single fake page could on its own. The use of sponsored search placement also meant victims encountered the fake tool through a channel they generally treat as safe.
Organizations can reduce exposure by reinforcing a few simple habits. Staff should be reminded that no legitimate website will ever ask them to copy and paste a command to prove they are human, and that this should be an automatic stop sign regardless of how official the surrounding page looks. Encourage employees to verify the real domain of any AI tool before interacting with it, especially when arriving via a sponsored or advertised link. Finally, since researchers found a new CustomGPT linked to the same campaign even after the first was taken down, organizations should treat reporting of suspicious AI tool lookalikes as an ongoing need rather than a one-time fix, and remind staff that look-alike campaigns can reappear quickly under new names.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
Attackers created a CustomGPT called Plus 5.6 designed to look like real ChatGPT, then used sponsored search results to direct users searching for 'chatgpt' on Google to it.
ClickFix is a technique where a fake CAPTCHA page asks the user to copy and paste a command to 'verify' themselves, which actually triggers a malicious download leading to a remote access trojan.
They should treat it as a major red flag since no legitimate website will ever ask a user to copy and paste a command to prove they're human, and should close the page and report it.
Researchers reported the Plus 5.6 CustomGPT to OpenAI and it was taken down as of September 25, but a new linked CustomGPT tied to the same campaign has already been identified.
You Google “chatgpt,” click the top sponsored result, and it even talks to you like real ChatGPT. But this one’s a fake CustomGPT called “Plus 5.6.” It pops up a “Service Availability Notice” and shoves you to a backup domain that looks like a Cloudflare CAPTCHA. Here’s the hook: the fake Cloudflare page tells you to copy and paste a command to prove you’re human. That ClickFix trick silently pulls down malware and a RAT that can watch, listen, and steal data. If any “ChatGPT” or CAPTCHA page ever asks you to paste a command, stop right there and report it to IT, do not paste anything.
Attackers abused real ChatGPT “Custom GPT” pages and a fake Cloudflare CAPTCHA to trick users into copying and pasting a PowerShell command on Windows. That command installed a malicious MSI and led to a multi-stage infection ending in a remote access trojan (RAT) with deep control of the victim’s…
Attackers used sponsored Google search ads to lure people to a malicious ChatGPT Custom GPT (“Plus 5.6”) hosted on the real chatgpt.com site. The Custom GPT redirected victims to a fake Cloudflare CAPTCHA page that instructed them to copy/paste a command into a terminal, leading to installation of…
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
Researchers observed threat actors creating attacker-made ChatGPT Custom GPTs that look legitimate, then steering users to a Google Sites “backup domain.” Victims are shown a fake Cloudflare CAPTCHA that tricks them into copying and running a malicious PowerShell command, which downloads and runs…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
