[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$f8upFdKt6lP8jBHvJh-YB8xVMQI7lumShVdmjTozCxXY":3},{"lesson":4},{"id":5,"slug":6,"article_id":7,"title":8,"body":9,"prevention":10,"framework_refs":11,"framework_notes":23,"status":24,"created_at":25,"published_at":26,"article":27,"tags":31,"podcasts":50,"controls":51},"160f8bb0-1694-46d3-9ef8-dbee169b816b","fake-chatgpt-custom-gpts-used-to-spread-remote-access-trojans-via-clickfix-lures","37f93621-76c5-4a66-b2ed-f2d132485b39","Fake ChatGPT Custom GPTs Used to Spread Remote Access Trojans via ClickFix Lures","Threat actors created malicious ChatGPT Custom GPTs that impersonate legitimate tools, tricking users into visiting attacker-controlled sites that deploy ClickFix social engineering lures. Victims are manipulated into executing a complex MSI installer chain that leverages DLL sideloading and shellcode execution to install a Remote Access Trojan (RAT). This attack demonstrates how emerging AI platforms can be weaponized as a distribution vector when platform-level controls and user vigilance are insufficient. With at least 40 confirmed infections, the campaign highlights the real-world impact of combining AI-platform abuse with layered malware delivery techniques. Organizations must treat AI tool usage as an expanded attack surface requiring both technical controls and user education.","**Immediate actions:**\n- Block or restrict end-user access to unvetted ChatGPT Custom GPTs through organizational AI usage policies.\n- Deploy endpoint detection and response (EDR) tools capable of detecting DLL sideloading, suspicious MSI execution, and shellcode injection behaviors.\n\n**User awareness & training:**\n- Train employees to recognize ClickFix and social engineering lures that prompt them to run commands or install software from browser prompts.\n- Establish a clear reporting procedure so users can quickly flag suspicious AI-generated content or unexpected software installation requests.\n\n**Long-term improvements:**\n- Implement application whitelisting to prevent unauthorized MSI installers and unsigned DLLs from executing on endpoints.\n- Develop and enforce an AI tool governance policy that vets and approves sanctioned AI platforms before organizational use.\n- Continuously monitor endpoint telemetry and network traffic for RAT command-and-control (C2) communication patterns using SIEM correlation rules.",[12,13,14,15,16,17,18,19,20,21,22],"CIS Control 2: Inventory and Control of Software Assets","CIS Control 9: Email and Web Browser Protections","CIS Control 14: Security Awareness and Skills Training","CIS Control 18: Penetration Testing","NIST SP 800-53 SI-3: Malicious Code Protection","NIST SP 800-53 AT-2: Literacy Training and Awareness","NIST SP 800-53 CM-7: Least Functionality","NIST SP 800-53 AU-6: Audit Record Review, Analysis, and Reporting","MITRE ATT&CK T1218.007: Msiexec (System Binary Proxy Execution)","MITRE ATT&CK T1574.002: DLL Side-Loading","MITRE ATT&CK T1204.002: Malicious File (User Execution)",{},"published","2026-09-30T16:22:19.359175+00:00","2026-09-30T16:22:19.003+00:00",{"id":7,"url":28,"slug":29,"title":30},"https:\u002F\u002Fthehackernews.com\u002F2026\u002F09\u002Fattackers-abuse-chatgpt-custom-gpts-to.html","attackers-abuse-chatgpt-custom-gpts-to-deliver-rat-via-clickfix-lures-72dbee","Attackers Abuse ChatGPT Custom GPTs to Deliver RAT via ClickFix Lures",[32,38,44],{"id":33,"name":34,"slug":35,"description":36,"color":37},"1732a005-556e-411c-a9db-5edec3058571","Logging & Monitoring","logging-monitoring","Missing logs, no alerting, blind spots","#a855f7",{"id":39,"name":40,"slug":41,"description":42,"color":43},"7261eb8f-acd4-4d93-a489-7fdd652ec0ea","Security Awareness","security-awareness","Phishing, social engineering, human error","#22c55e",{"id":45,"name":46,"slug":47,"description":48,"color":49},"859cf0ad-a7e9-42bb-a75d-bac6511fa5d5","Configuration Management","configuration-management","Misconfigs, default credentials, exposed services","#eab308",[],[52,56,60],{"slug":53,"name":54,"problem":55},"endpoint-detection-response","Endpoint detection and response (EDR and XDR)","Malware and hands-on-keyboard attackers on laptops and servers get spotted and stopped.",{"slug":57,"name":58,"problem":59},"email-security","Email security","Phishing, malware and invoice fraud are filtered out before they reach inboxes.",{"slug":61,"name":62,"problem":63},"security-awareness-training","Security awareness training and phishing simulation","People recognise and report attacks instead of falling for them."]