[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fbSrN5BoPgIbJqpKOnkiDid1n6By-FtZRtQTbDc2TQ78":3},{"article":4,"iocs":53,"watch_terms":65,"solutions":66,"lesson":157},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a2067169-01a2-4657-9147-cf66f00b285d","Custom ChatGPTs push ClickFix attacks to deploy RAT malware","custom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware-aafd86","Custom variants of OpenAI's ChatGPT promoted in sponsored Google results are directing unsuspecting users to malicious sites that use ClickFix attacks to deliver malware. [...]","Threat actors are leveraging custom ChatGPT variants, promoted through sponsored Google ads, to lure users into downloading RAT malware. These malicious custom GPTs direct users to fake sites that employ ClickFix attacks, ultimately deploying a remote access trojan. The campaign, identified by Huntress, uses legitimate ChatGPT.com domain for malicious instructions, increasing its deceptive power.","Custom ChatGPTs are used to trick users into downloading RAT malware via ClickFix attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fcustom-chatgpts-push-clickfix-attacks-to-deploy-rat-malware\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F09\u002F29\u002Fchatgpt.jpg","2026-09-29T20:59:39+00:00","2026-09-29T22:00:19.595743+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"ChatGPT","product",{"name":21,"type":22},"OpenAI","vendor",{"name":24,"type":25},"AI","technology",{"name":27,"type":22},"Huntress",{"name":29,"type":19},"Google Sites","89f78b1c-3503-45a1-9fc7-e23d2ce1c6d5",{"id":30,"icon":32,"name":33,"slug":34},null,"Malware","malware",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"839da5c1-3c34-47e2-9499-f7201640e3ac","AI Security","ai-security",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54,57,61],{"type":34,"value":55,"context":56},"RAT","Payload delivered by the custom ChatGPT campaign",{"type":58,"value":59,"context":60},"url","https:\u002F\u002Fchat.openai.com\u002F","Legitimate domain used to host malicious instructions for custom GPTs",{"type":62,"value":63,"context":64},"domain","sites.google.com","Hosting for alleged backup sites used in the campaign",[21,27,18],{"controls":67,"vendors":151},[68,97,126],{"slug":69,"name":70,"problem":71,"products":72},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",[73,81,89],{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"sophos","Sophos","\u002Fvendor-logos\u002Fsophos.png","sophos-endpoint","Sophos Endpoint","https:\u002F\u002Fwww.sophos.com\u002Fen-us\u002Fproducts\u002Fendpoint-security","Endpoint protection with Intercept X anti-ransomware technology and EDR.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"elastic","Elastic","\u002Fvendor-logos\u002Felastic.png","elastic-security","Elastic Security","https:\u002F\u002Fwww.elastic.co\u002Fsecurity","SIEM and endpoint security built on Elasticsearch, with open detection rules.",{"vendor_slug":90,"vendor_name":91,"vendor_logo":92,"product_slug":93,"product_name":94,"url":95,"description":96},"eset","ESET","\u002Fvendor-logos\u002Feset.png","eset-protect","ESET PROTECT","https:\u002F\u002Fwww.eset.com\u002Fint\u002Fbusiness\u002Fsolutions\u002Fendpoint-protection\u002F","Endpoint protection platform with detection and response add-ons.",{"slug":98,"name":99,"problem":100,"products":101},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",[102,110,118],{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"mimecast","Mimecast","\u002Fvendor-logos\u002Fmimecast.png","mimecast-email-security","Mimecast Email Security","https:\u002F\u002Fwww.mimecast.com\u002Fproducts\u002Femail-security\u002F","Email filtering, impersonation protection and continuity.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-email-security","Cloudflare Email Security","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Femail-security\u002F","Email filtering for phishing and business email compromise.",{"vendor_slug":119,"vendor_name":120,"vendor_logo":121,"product_slug":122,"product_name":123,"url":124,"description":125},"abnormal","Abnormal AI","\u002Fvendor-logos\u002Fabnormal.png","abnormal-email-security","Abnormal Inbound Email Security","https:\u002F\u002Fabnormal.ai\u002F","API-based email security for Microsoft 365 and Google Workspace using behavioural models.",{"slug":127,"name":128,"problem":129,"products":130},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them.",[131,137,144],{"vendor_slug":132,"vendor_name":133,"vendor_logo":134,"product_slug":132,"product_name":133,"url":135,"description":136},"hoxhunt","Hoxhunt","\u002Fvendor-logos\u002Fhoxhunt.png","https:\u002F\u002Fhoxhunt.com\u002F","Adaptive phishing simulations and micro-training, with a focus on reporting.",{"vendor_slug":138,"vendor_name":139,"vendor_logo":140,"product_slug":127,"product_name":141,"url":142,"description":143},"knowbe4","KnowBe4","\u002Fvendor-logos\u002Fknowbe4.png","KnowBe4 Security Awareness Training","https:\u002F\u002Fwww.knowbe4.com\u002Fproducts\u002Fsecurity-awareness-training","Training library and simulated phishing with reporting.",{"vendor_slug":145,"vendor_name":146,"vendor_logo":147,"product_slug":145,"product_name":148,"url":149,"description":150},"sosafe","SoSafe","\u002Fvendor-logos\u002Fsosafe.png","SoSafe Awareness Platform","https:\u002F\u002Fsosafe-awareness.com\u002F","Behaviour-based awareness training and phishing simulation in many languages.",[152],{"slug":153,"name":27,"logo_path":154,"roles":155},"huntress","\u002Fvendor-logos\u002Fhuntress.png",[156],"reported_by",{"slug":158,"title":159,"body":160,"framework_refs":161,"framework_notes":174},"fake-chatgpt-ads-use-clickfix-to-deploy-remote-access-trojans","Fake ChatGPT Ads Use ClickFix to Deploy Remote Access Trojans","Threat actors are weaponizing sponsored Google ads and custom ChatGPT variants to trick users into visiting malicious sites that deploy remote access trojan (RAT) malware via ClickFix social engineering techniques. The attack exploits user trust in the legitimate ChatGPT.com domain, making deception significantly harder to detect for the average user. ClickFix attacks typically instruct victims to manually run malicious commands under the guise of fixing a problem, bypassing many traditional security controls. This campaign highlights how AI brand recognition is now being actively weaponized to lower user suspicion and increase infection rates. Organizations without strong end-user training and ad-blocking controls are particularly exposed.",[162,163,164,165,166,167,168,169,170,171,172,173],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 17: Incident Response Management","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 SC-18: Mobile Code","NIST SP 800-53 SI-3: Malicious Code Protection","NIST CSF DE.CM-1: Network and system monitoring","NIST CSF PR.AT-1: Awareness and training for all users","MITRE ATT&CK T1204.002: User Execution – Malicious File","MITRE ATT&CK T1059: Command and Scripting Interpreter","GDPR Article 32: Security of processing (for organizations handling EU personal data)",{}]