Attackers used sponsored Google search ads to lure people to a malicious ChatGPT Custom GPT (“Plus 5.6”) hosted on the real chatgpt.com site. The Custom GPT redirected victims to a fake Cloudflare CAPTCHA page that instructed them to copy/paste a command into a terminal, leading to installation of a remote access trojan (RAT). Huntress reported dozens of real incidents tied to this campaign.
This campaign combined trust in a well-known platform with a classic ClickFix technique. Attackers bought sponsored Google Search placement for the term chatgpt, directing searchers to a malicious Custom GPT named Plus 5.6. Because the Custom GPT was hosted on the real chatgpt.com domain, it inherited a level of trust that a standalone phishing site would not have.
When a victim tried to use the GPT, it claimed the service was unavailable and pointed them to a Backup Domain hosted on Google Sites. That page impersonated a Cloudflare CAPTCHA check. Rather than a simple click-to-verify box, the page instructed users to copy a command and paste it into their Terminal. Running that command kicked off a chain that ended with installation of a full-featured remote access trojan, sideloaded using legitimately signed executables from Canon and later Stardock.
Several layers of legitimacy stacked on top of each other. The lure started with a paid search ad, a channel people generally associate with real vendors. It then routed through the authentic chatgpt.com site itself, and only later pivoted to a Google Sites page dressed up as a Cloudflare security check. Each step borrowed credibility from a trusted brand, Google, OpenAI, and Cloudflare, without any of those organizations being at fault. By the time users reached the copy-paste instruction, they had already crossed several trust checkpoints and were primed to comply.
Security responders noted at least 40 incidents tied to the Google Sites domain used in this campaign, with some confirmed to originate directly from a Custom GPT instance. Even after the first malicious GPT was removed, attackers created a replacement and kept iterating.
Organizations should pursue layered defense rather than relying on user awareness alone. Train employees to treat any copy-paste-into-terminal instruction as an automatic stop signal, since no legitimate CAPTCHA or fix will ever ask for that. Pair this training with technical controls such as restricting the Run dialog for standard users and locking down PowerShell execution. Encourage healthy skepticism toward sponsored search results and remind users that a page's appearance or hosting location, even a familiar one, is not proof of legitimacy. Finally, ensure detection and response capabilities exist to catch execution attempts even when a user does fall for the lure.
Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.
They used sponsored Google Search results for people searching the term chatgpt, which led victims to a Custom GPT called Plus 5.6 hosted on the legitimate chatgpt.com site.
The malicious GPT was hosted on the real chatgpt.com domain, which increased user trust, and it redirected users to a fake Cloudflare CAPTCHA check on Google Sites before delivering the ClickFix-style command prompt.
Any CAPTCHA or verification page that asks you to copy and paste a command into Terminal, PowerShell, the Run dialog, or a command prompt is not legitimate and should be treated as an active attack.
Yes, OpenAI removed the first malicious GPT, but the attackers created a second one and continued iterating, according to the reporting.
You Google “chatgpt,” click the top sponsored result, and land on a Custom GPT called “Plus 5.6” on the real chatgpt.com. Looks legit, right? But when you try to use it, it says the service is unavailable and shuttles you to a “Backup Domain” on Google Sites that looks like a Cloudflare CAPTCHA check. Here’s the trap: the fake CAPTCHA tells you to copy a long command into Terminal or PowerShell to ‘fix access.’ That one paste quietly installs a full remote access trojan on your machine. Remember this: no real CAPTCHA or website will ever ask you to paste commands into Terminal or PowerShell. If a page does that, stop immediately and report it to IT.
A real ClickFix campaign abused ChatGPT “Custom GPTs” to impersonate legitimate tools and trick people into running PowerShell commands on their own computers. Victims were funneled from a sponsored Google result to a fake “backup domain” on Google Sites with a Cloudflare CAPTCHA-style prompt,…
Microsoft and partners disrupted “EvilTokens,” a phishing-as-a-service platform Microsoft links to over 12,000 compromised inboxes across more than 10,000 organizations. The service used deceptive emails to trick people into pasting a “device code” into Microsoft’s real sign-in page…
Attackers compromised Brevo’s Cloudflare setup using a long-lived API key found in source code, then altered website content at the CDN edge. Visitors were shown fake Cloudflare verification prompts to run Windows commands, and logged-in WordPress admins were targeted with a hidden backdoor plugin…
A real-world social engineering attempt used a legitimate Google Doc to trick a target into manually running commands that installed malware. The attacker posed as a crypto marketing executive and used a fake “decryption failure” message and a “manual update” button as the lure, leading to an…
The article describes multiple real-world social engineering operations this week, including phishing sent from a legitimate Trezor newsletter channel and malware pushed through a verified HBO Max Reddit ad account. It also highlights a large-scale network of fake online stores impersonating real…
The recap describes a real Microsoft 365 phishing campaign using DocuSign-themed emails that push victims through multiple redirects to a fake sign-in page. The goal is to steal session tokens (so attackers can log in even if a password changes) and also perform “device code” style sign-in abuse.…
