Attackers used sponsored Google search ads to lure people to a malicious ChatGPT Custom GPT (“Plus 5.6”) hosted on the real chatgpt.com site. The Custom GPT redirected victims to a fake Cloudflare CAPTCHA page that instructed them to copy/paste a command into a terminal, leading to installation of a remote access trojan (RAT). Huntress reported dozens of real incidents tied to this campaign.
This campaign combined trust in a well-known platform with a classic ClickFix technique. Attackers bought sponsored Google Search placement for the term chatgpt, directing searchers to a malicious Custom GPT named Plus 5.6. Because the Custom GPT was hosted on the real chatgpt.com domain, it inherited a level of trust that a standalone phishing site would not have.
When a victim tried to use the GPT, it claimed the service was unavailable and pointed them to a Backup Domain hosted on Google Sites. That page impersonated a Cloudflare CAPTCHA check. Rather than a simple click-to-verify box, the page instructed users to copy a command and paste it into their Terminal. Running that command kicked off a chain that ended with installation of a full-featured remote access trojan, sideloaded using legitimately signed executables from Canon and later Stardock.
Several layers of legitimacy stacked on top of each other. The lure started with a paid search ad, a channel people generally associate with real vendors. It then routed through the authentic chatgpt.com site itself, and only later pivoted to a Google Sites page dressed up as a Cloudflare security check. Each step borrowed credibility from a trusted brand, Google, OpenAI, and Cloudflare, without any of those organizations being at fault. By the time users reached the copy-paste instruction, they had already crossed several trust checkpoints and were primed to comply.
Security responders noted at least 40 incidents tied to the Google Sites domain used in this campaign, with some confirmed to originate directly from a Custom GPT instance. Even after the first malicious GPT was removed, attackers created a replacement and kept iterating.
Organizations should pursue layered defense rather than relying on user awareness alone. Train employees to treat any copy-paste-into-terminal instruction as an automatic stop signal, since no legitimate CAPTCHA or fix will ever ask for that. Pair this training with technical controls such as restricting the Run dialog for standard users and locking down PowerShell execution. Encourage healthy skepticism toward sponsored search results and remind users that a page's appearance or hosting location, even a familiar one, is not proof of legitimacy. Finally, ensure detection and response capabilities exist to catch execution attempts even when a user does fall for the lure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They used sponsored Google Search results for people searching the term chatgpt, which led victims to a Custom GPT called Plus 5.6 hosted on the legitimate chatgpt.com site.
The malicious GPT was hosted on the real chatgpt.com domain, which increased user trust, and it redirected users to a fake Cloudflare CAPTCHA check on Google Sites before delivering the ClickFix-style command prompt.
Any CAPTCHA or verification page that asks you to copy and paste a command into Terminal, PowerShell, the Run dialog, or a command prompt is not legitimate and should be treated as an active attack.
Yes, OpenAI removed the first malicious GPT, but the attackers created a second one and continued iterating, according to the reporting.
You Google “chatgpt,” click the top sponsored result, and land on a Custom GPT called “Plus 5.6” on the real chatgpt.com. Looks legit, right? But when you try to use it, it says the service is unavailable and shuttles you to a “Backup Domain” on Google Sites that looks like a Cloudflare CAPTCHA check. Here’s the trap: the fake CAPTCHA tells you to copy a long command into Terminal or PowerShell to ‘fix access.’ That one paste quietly installs a full remote access trojan on your machine. Remember this: no real CAPTCHA or website will ever ask you to paste commands into Terminal or PowerShell. If a page does that, stop immediately and report it to IT.
Researchers found a real malware campaign where attackers abused ChatGPT “CustomGPTs” and Google sponsored search results to funnel victims to a fake ChatGPT experience. Victims are shown a fake “Service Availability Notice” and pushed to a “backup domain” that looks like a Cloudflare CAPTCHA,…
Attackers abused real ChatGPT “Custom GPT” pages and a fake Cloudflare CAPTCHA to trick users into copying and pasting a PowerShell command on Windows. That command installed a malicious MSI and led to a multi-stage infection ending in a remote access trojan (RAT) with deep control of the victim’s…
Researchers observed threat actors creating attacker-made ChatGPT Custom GPTs that look legitimate, then steering users to a Google Sites “backup domain.” Victims are shown a fake Cloudflare CAPTCHA that tricks them into copying and running a malicious PowerShell command, which downloads and runs…
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
Attackers are using sponsored Google ads to route people to a malicious “custom GPT” that looks like ChatGPT, even while the user is logged in on the real ChatGPT domain. The fake GPT displays a convincing “service availability” message and pushes a link to a “backup domain” that ultimately…
Criminals used sponsored Google search results to promote a malicious ChatGPT “Custom GPT” called “Plus 5.6.” Victims were led to a fake Cloudflare CAPTCHA page that ultimately tricked them into downloading and running a remote access trojan (RAT). This is a realistic web-based lure that can be…
